The WPSchoolPress WordPress plugin fails to enforce a capability check in its wpsp_DeleteUser() function, allowing any authenticated user with teacher-level access or higher to delete any user account. This flaw can result in the loss of user profiles and the data associated with them, disrupting school operations. The weakness is a missing authorization control (CWE-862).

All installations of the WPSchoolPress plugin with version 2.2.16 or earlier are vulnerable. The vendor is jdsofttech and the product is the School Management System – WPSchoolPress, available as a WordPress plugin. The issue is fixed in version 2.2.17 and later.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session with teacher-level or higher privileges, with no publicly exploitable incident vector reported. The risk is moderate, but the practical exploitation probability remains low under current circumstances.