CVE-2022-1609 Scanner

School Management Pro is a premium WordPress plugin designed to automate school administration tasks such as fee collection, attendance tracking, exam management, and result publishing. It is widely deployed by educational institutions to centralize operations on their WordPress sites, handling sensitive student and financial data. The plugin integrates deeply with WordPress, often requiring elevated privileges for core functions.

CVE-2022-1609 is a critical remote code execution vulnerability that stems from insufficient input validation in the plugin's AJAX handlers. The flaw allows unauthenticated attackers to inject and execute arbitrary PHP code because the plugin fails to sanitize user-supplied data before passing it to dangerous functions like eval() or system(). This backdoor-like behavior bypasses standard WordPress authentication and authorization checks.

Specifically, the vulnerability resides in the admin-ajax.php endpoint, where the plugin registers actions that accept user input without proper capability checks. Attackers can craft a POST request with malicious payloads in parameters such as 'action' and 'data', which the plugin then processes unsafely. No prior authentication or special headers are required, making exploitation trivial for anyone with network access to the WordPress site.

If exploited, an attacker gains complete control over the WordPress installation, including the ability to modify files, steal database contents, install additional malware, and pivot to other servers on the network. Given the CVSS score of 10.0, this vulnerability poses an existential threat to site integrity and data confidentiality, often leading to full site compromise and reputational damage for the educational institution.