The Mojoomla School Management plugin for WordPress contains an unrestricted upload flaw that allows a user to upload files of any type, including web shells. This vulnerability, documented as CWE‑434, gives an attacker the ability to place executable code on the web server and run it with the server’s privileges, constituting a remote code execution risk.

WordPress sites that have installed the Mojoomla School Management plugin, versions from the initial release up to and including 1.93.1 (dated 02‑07‑2025).

The CVSS score of 9.9 labels the flaw as Critical, while the EPSS score of < 1 % implies a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the plugin’s file‑upload interface; an attacker can supply an arbitrary file payload, which the server stores in a publicly accessible directory, then executes the file as code.