CVE-2022-1609: The School Management < 9.9.7 - Unauthenticated RCE via REST api

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 64.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-16 · updated 2026-06-17
Weakness: CWE-94

Description

The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.

Affected products

school-management-pro: before 9.9.7 — fixed in 9.9.7

How to fix

Upgrade to a fixed version: school-management-pro 9.9.7. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/e2d546c9-85b6-47a4-b951-781b9ae5d0f2/
https://wpscan.com/vulnerability/e2d546c9-85b6-47a4-b951-781b9ae5d0f2/

Get alerted when CVE-2022-1609 or the next vulnerability affects your stack