The WPSchoolPress plugin for WordPress contains an unescaped parameter in the 'addNotify' action, which permits an authenticated user with teacher or higher privileges to inject arbitrary SQL into the backend query. This leads to the ability to read or modify data exposed in the database, constituting a data exfiltration vulnerability. The flaw is classified as CWE-89, reflecting improper constraint or sanitization of SQL input.

WordPress installations running the jdsofttech School Management System – WPSchoolPress plugin up to and including version 2.2.17. The affected code resides in the plugin’s lib/wpsp-ajaxworks.php file. Users of any WordPress instance that has installed this plugin within the specified version range are susceptible.

The issue has a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1%, implying a very low but non‑zero exploitation probability. It is not currently listed in the CISA KEV catalog. The most likely attack path requires the attacker to first log in as a teacher or higher role, then target the addNotify endpoint via the web interface or API. Once authenticated, the attacker can embed malicious SQL fragments that the plugin concatenates into a larger query, enabling data retrieval or modification.