The School Management System – WPSchoolPress plugin for WordPress is affected by a SQL injection flaw in the 'SCodes' parameter. The insufficient escaping and lack of proper query preparation allow an attacker with administrator or higher privileges to append arbitrary SQL statements, which can be used to read or manipulate sensitive data stored in the database. This weakness is categorized as CWE-89, indicating an injection vulnerability that exposes confidentiality and potentially integrity of the system.

Vendors affected include JDSoftTech’s School Management System – WPSchoolPress. All versions up to and including 2.2.23 are vulnerable. Users should verify the installed version and consider upgrading once a fix is available.

The CVSS score of 4.9 reflects a moderate risk, while the EPSS score of less than 1% indicates a very low probability of exploitation in the current environment. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation. However, the attack requires an authenticated administrator account, which means that compromised credentials or insider threats can leverage the flaw. Because the attacker can append SQL, the impact could involve unauthorized data leakage or alteration. Organizations should treat this as a manageable risk that can be mitigated through patching and monitoring.