This vulnerability is an incorrect privilege assignment issue within the Mojoomla School Management plugin for WordPress. It allows a user with lower level permissions to elevate their access rights to those of a higher‑privilege role, potentially giving them administrative control over the plugin and related CMS data. The impact is an attacker able to modify, delete, or create content, alter settings, or compromise the overall integrity of the site.

The affected product is the Mojoomla School Management WordPress plugin, versions up to and including 93.2.0. Any installation using these or earlier releases is vulnerable and must be updated to a newer non‑vulnerable version.

With a CVSS score of 8.8, this issue is classified as high severity. The EPSS score is not available, but the lack of KEV listing does not diminish the risk. The vulnerability is likely exploitable by a remote attacker with normal user access who can send crafted requests to the plugin’s endpoints to manipulate internal role assignments. Once compromised, the attacker can gain full administrative capabilities within the WordPress site.