The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_DeleteUser() function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access and above, to delete arbitrary user accounts.
References
Configurations
History
28 Mar 2025, 20:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/lib/wpsp-ajaxworks.php#L22 - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/fd5638b6-134d-4386-af40-6ac961a915d7?source=cve - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| First Time |
Igexsolutions wpschoolpress
Igexsolutions |
|
| CPE | cpe:2.3:a:igexsolutions:wpschoolpress:*:*:*:*:*:wordpress:*:* |
15 Mar 2025, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-15 04:15
Updated : 2025-03-28 20:00
NVD link : CVE-2025-1668
Mitre link : CVE-2025-1668
JSON object : View
Products Affected
igexsolutions
- wpschoolpress
CWE
CWE-862
Missing Authorization