VULNERABILITY INTELLIGENCE

CVE-2022-1609

CVSS score9.8 CRITICAL
EPSS probability64.08%
CISA KEVNot currently listed
Published2024-01-16
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references