The vulnerability is a classic SQL Injection flaw in the 'order[0][dir]' parameter used by several AJAX handlers of the School Management plugin. It allows an attacker who is authenticated with a custom level or higher to inject arbitrary SQL code into existing queries, enabling the extraction of sensitive database contents. Because the injection occurs in multiple endpoints, the potential impact is broad across user, staff, and financial records. The flaw also lacks nonce verification on several handlers, which can be leveraged for CSRF-chained attacks, thereby possibly amplifying the scope of data exposure.

The affected systems are WordPress installations that include the Weblizar School Management – Education & Learning ERP plugin, versions 5.4 and all earlier releases. Any site that uses these plugin versions is at risk.

The CVSS score of 6.5 indicates moderate severity, so attackers are likely to target this flaw if they can authenticate to the site. Although EPSS data is unavailable, the absence of a KEV listing does not preclude exploitation; the flaw is fully exploitable by users with sufficient privileges and, through CSRF chaining, may affect unauthenticated attackers with some site interaction. Proper role-based restrictions and timely patching can mitigate the risk. The attack vector is presumed to be authenticated through WordPress, with potential escalation via a CSRF chain that bypasses nonce checks on several AJAX endpoints.