School Management CVE-2025-15657

No special conditions are required for exploitation - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against default installations of the Mojoomla School Management WordPress plugin. The limiting factor is that the vulnerable plugin must be installed and active on the target WordPress site, and the affected endpoint must be reachable over the network (standard for most WordPress deployments). Exploitation is bounded to read-only confidentiality impact (C:L); no write access, code execution, or service disruption is implied by the available data. The scope is unchanged (S:U), meaning the vulnerability does not chain into broader WordPress core or server compromise on its own.

The CVSS 3.1 base score of 5.3 (Medium) is supported by the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that exploitation is straightforward and requires no authentication, but impact is limited to partial confidentiality - no integrity or availability risk is asserted. The low attack complexity combined with no privilege or user interaction requirements makes this a realistic target of automated enumeration scripts against exposed WordPress installations. No EPSS score was provided in the source data, limiting probabilistic exploitation forecasting. Neither KEV status nor public proof-of-concept code has been identified, suggesting exploitation remains opportunistic rather than widespread or targeted. The realistic concern for organizations running this plugin is bulk data harvesting of personally identifiable information (student records, enrollment data) through sequential ID enumeration - a scenario that, while not catastrophic in scope, carries significant compliance and privacy implications for educational institutions subject to FERPA, GDPR, or similar frameworks.

An unauthenticated attacker discovers a public-facing WordPress site running the School Management plugin and sends a series of crafted HTTP GET or POST requests to the plugin's AJAX or REST endpoint, incrementing a numeric student or record ID parameter (e.g., student_id=1, student_id=2, ...). The server returns the associated record for each valid ID without verifying session context, enabling bulk enumeration of student names, enrollment data, or contact information. No public exploit tool is currently known, but this attack is trivially scriptable.