EUVD-2026-59904
GHSA-mjq3-78vf-6gv2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible AJAX handler requires custom-level WordPress authentication; SQL injection is read-only with no integrity or availability impact per the description.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The The School Management - Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is replicated across seven or more AJAX handlers including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments, and the missing nonce verification on several of these handlers also enables CSRF-chained exploitation.
AnalysisAI
SQL injection in Weblizar's School Management - Education & Learning ERP WordPress plugin (versions ≤5.4) enables authenticated attackers with custom-level access to exfiltrate arbitrary database records by manipulating the unsanitized order[0][dir] sort-direction parameter across at least seven AJAX handlers. The vulnerability's attack surface is compounded by missing nonce verification on several of those same handlers, enabling a CSRF-chained exploitation path that effectively bypasses the authentication prerequisite when an authenticated user can be lured to a malicious page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The direct authenticated exploitation path requires a valid WordPress account with custom-level access or above on the target site; the School Management - Education & Learning ERP plugin must be installed, active, and at version 5.4 or below. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly characterizes the direct authenticated exploitation path: low-complexity network attack requiring a custom-level WordPress account, yielding high confidentiality impact with no integrity or availability damage. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a custom-level WordPress account on an affected school site submits an AJAX request to the wlsm-fetch-staff-classes handler with the `order[0][dir]` parameter set to a malicious value such as `ASC,(SELECT password FROM wp_users LIMIT 1)--`, causing the injected subquery to execute within the existing SQL statement and return hashed credentials or PII in the AJAX response. Alternatively, using the CSRF path on a handler lacking nonce verification, an unauthenticated attacker embeds the forged AJAX request in a malicious webpage and tricks an authenticated administrator into visiting it, triggering the same SQL injection without possessing any WordPress credentials. … |
| Remediation | An upstream code change is referenced in the WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3570107%40school-management-system&new=3570107%40school-management-system), indicating a fix has been committed; however, the exact patched release version number is not confirmed in available data - administrators should update to the latest available version via the WordPress admin dashboard and verify the installed version exceeds 5.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today