CVE-2025-15657
MediumCVSS 5.3Summary
In School Management versions <= 93.1.0, there is a vulnerability of unauthenticated insecure direct object references (IDOR). This allows attackers to access data they should not have access to.
Risk Assessment
Organizations may be exposed to data leaks and unauthorized access to sensitive information, which can lead to serious legal and reputational consequences.
Recommendation
It is recommended to update to the latest version of the software to eliminate this vulnerability and implement appropriate authorization mechanisms.
Other vulnerabilities in School Management
See all- CVE-2025-15656High
The School Management plugin for WordPress versions up to 93.2.0 has an incorrect privilege assignment vulnerability allowing privilege escalation.
- CVE-2025-15655High
The School Management plugin for WordPress versions up to 93.2.0 is vulnerable to SQL injection, allowing SQL query injection.
Original NVD description (English source)
Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.