The vulnerability is a missing authorization check in the Mojoomla School Management plugin. Incorrectly configured access control allows attackers to bypass user permissions and access or modify sensitive data, which can lead to data exposure or unauthorized changes.

All installations of the School Management plugin from its earliest release up through version 93.2.0 are affected. The plugin is typically deployed on WordPress sites that use it to manage student records, schedules, and other administrative functions. Anyone with a user account on such a site could exploit the flaw if the plugin’s configuration is lax.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is currently very unlikely. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit this flaw by making web requests to the plugin’s endpoints, potentially using an authenticated user account to elevate privileges. Although widespread attacks are presently infrequent, the exposure of sensitive educational data remains significant.