School Management CVE-2025-15655

Exploitation requires the attacker to already hold a high-privileged authenticated session within the WordPress site running the Mojoomla School Management plugin at version 93.2.0 or earlier (CVSS PR:H), which in practice means an administrative or equivalent staff role with access to the plugin's management interface. No user interaction by a second party is needed (UI:N), and the attack is delivered over the network against the WordPress HTTP(S) interface (AV:N) with low complexity (AC:L). Exploitation is limited to deployments that have the plugin installed and enabled and where untrusted parties can plausibly obtain high-privileged credentials; sites that strictly limit elevated roles to a small trusted set materially reduce realistic exposure.

The CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) indicates network-reachable, low-complexity exploitation but requires high privileges, meaning an attacker needs an elevated account (e.g., admin-level or equivalent role within the school management workflow) before triggering the flaw - substantially limiting opportunistic mass exploitation. The high confidentiality impact and changed scope are notable: a compromised privileged account can pivot through SQL injection into the broader WordPress database. No EPSS score, KEV listing, or public PoC was provided, suggesting this is not currently a widespread, automated exploitation target. The realistic risk is moderate and primarily relevant to multi-tenant or shared WordPress deployments where insider-threat or compromised-credentials scenarios are plausible; no conflicting signals were observed in the supplied data, though the absence of EPSS makes likelihood quantification uncertain.

An attacker who has obtained or been granted a high-privileged School Management account (e.g., through credential phishing, password reuse, or insider access) submits a crafted parameter to a vulnerable plugin endpoint that concatenates the value into a SQL query. The injection exfiltrates sensitive data from WordPress core tables - including password hashes, API keys stored in wp_options, and student PII - and the Scope:Changed rating means the impact extends beyond the plugin to the entire shared database. No public proof-of-concept is referenced, so exploitation would currently require independent vulnerability research.