The WPSchoolPress plugin for WordPress has a flaw in the wpsp_UpdateTeacher() function that omits a capability check. This vulnerability allows authenticated users holding teacher-level or higher permissions to modify any user record, including changing email addresses. By doing so, the attacker can trigger password reset requests for arbitrary accounts, thereby gaining access to administrator or other privileged user accounts. The impact is the loss of confidentiality and integrity of all accounts within the WordPress installation.

The vulnerability applies to the jdsofttech School Management System – WPSchoolPress plugin for WordPress, specifically all releases up to and including version 2.2.16. The affected code resides in the wpsp-ajaxworks-teacher.php file within the plugin archive. Users running any of these versions on a WordPress site are at risk.

The CVSS score of 8.8 indicates a high severity, and the EPSS score of less than 1% suggests the flaw has not been widely exploited yet, though its presence in CISA KEV is not reported. The attack vector requires an authenticated teacher-level or higher account; once such a user is compromised or deliberately used, privilege escalation can be achieved. Therefore the threat remains significant for environments where teacher roles are widely granted or where user passwords are weak.