The WPSchoolPress plugin for WordPress contains an SQL Injection flaw in the ‘cid’ parameter that is insufficiently sanitized in all releases up to and including 2.2.16. Authenticated attackers possessing Custom-level access or higher can append malicious SQL commands to existing queries, enabling them to read sensitive data from the database. This vulnerability is a classic example of CWE‑89 and does not provide a path to arbitrary code execution but does allow unauthorized disclosure of private information.

All versions of the WPSchoolPress plugin for WordPress released by jdsofttech, specifically those up to and including version 2.2.16, are affected. The flaw resides in the PHP code that constructs database queries based on the ‘cid’ parameter. It does not impact other versions such as 2.2.17 and later, nor does it affect WordPress itself outside of the plugin.

The CVSS v3.1 score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog, further supporting a lower risk posture. However, because the attacker requires authenticated access at Custom level or higher, the threat is limited to users who control or can obtain such credentials – for example, individual parents or teachers. Once authenticated, the attacker can harvest data but not gain system-wide compromise or privilege escalation.