Mojoomla School Management CVE-2025-15656

Attacker must hold a valid authenticated low-privileged WordPress account (PR:L) on a site where the Mojoomla School Management plugin version ≤ 93.2.0 is installed and activated; no user interaction or non-default configuration is required beyond the plugin being enabled. Exploitation is limited by the need to first obtain that low-privilege account - trivial on installations that permit open self-registration for parents/students/staff, but a meaningful barrier on closed deployments where account provisioning is administrator-controlled. No specific platform, browser, or PHP version constraint is indicated in the available data.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-reachable, low-complexity exploitation by an already authenticated low-privileged user with no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with takeover of the WordPress site. KEV status is not listed and there is no public exploit identified at time of analysis, and no EPSS score was provided in the input, so widespread opportunistic exploitation cannot be confirmed. The realistic risk profile is therefore high for any deployment that allows untrusted user registration (e.g., parents, students, staff accounts) because the prerequisite low-privilege account is trivial to obtain in a typical school-management deployment, but lower for hardened installations that restrict account creation. No conflicting signals were detected between the description and the CVSS vector.

An attacker registers or obtains a low-privileged account (e.g., student, parent, or subscriber) on a WordPress site running Mojoomla School Management ≤ 93.2.0, then sends a crafted request to a plugin endpoint that incorrectly assigns elevated capabilities, granting the attacker administrator-level access. With administrator rights, the attacker installs a malicious plugin or theme to achieve remote code execution, exfiltrate student/staff PII, and pivot to the underlying host. No public exploit is identified at time of analysis, but the low attack complexity makes weaponization straightforward once details are reverse-engineered from the patch.