CVE-2026-9767 in The School Management Plugin
Summary
by MITRE • 08/16/2026
The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is replicated across seven or more AJAX handlers including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments, and the missing nonce verification on several of these handlers also enables CSRF-chained exploitation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
The School Management – Education & Learning ERP plugin for WordPress presents a critical generic SQL injection vulnerability affecting all versions up to and including 5.4. This vulnerability stems from inadequate input sanitization of the 'order[0][dir]' parameter within multiple AJAX handlers, creating a pathway for authenticated attackers with custom-level privileges or higher to manipulate database queries through malicious input manipulation. The flaw resides in the plugin's insufficient escaping mechanisms and lack of proper SQL query preparation, allowing attackers to append additional SQL commands to existing queries and potentially extract sensitive database information.
The technical exploitation occurs through seven or more AJAX handlers including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments, which all share the same vulnerable parameter structure. This widespread vulnerability across multiple endpoints amplifies the attack surface significantly, as a single exploitation vector can compromise multiple data retrieval functions within the educational management system. The absence of nonce verification on several handlers further compounds the risk by enabling CSRF-chained exploitation scenarios where attackers can leverage cross-site request forgery to execute malicious SQL injection attacks without direct user interaction.
This vulnerability directly maps to CWE-89 SQL Injection and aligns with ATT&CK technique T1071.004 Application Layer Protocol: DNS, as it exploits the application's database communication layer through manipulated parameter inputs. The impact extends beyond simple data extraction to potentially allow full database compromise, including access to student records, staff information, financial data, and other sensitive educational management system details. Attackers can leverage this vulnerability to perform unauthorized data manipulation, create backdoor accounts, or escalate privileges within the WordPress environment.
The operational consequences of this vulnerability are severe for educational institutions relying on the plugin for their ERP functionality. Database breaches could expose confidential student and staff information, potentially violating privacy regulations such as FERPA or GDPR compliance requirements. The authenticated nature of the attack means that even compromised user accounts with limited privileges can escalate to full database access, making this a particularly dangerous vulnerability in environments where multiple users have varying levels of system access. Organizations should implement immediate mitigation strategies including plugin updates, input validation enforcement, and monitoring for suspicious database queries.
Mitigation recommendations include upgrading to the latest plugin version where the SQL injection vulnerability has been addressed, implementing proper input sanitization and parameterized queries throughout all AJAX handlers, and enforcing nonce verification on all affected endpoints. Security teams should monitor WordPress logs for unusual query patterns and consider implementing web application firewalls with SQL injection detection capabilities. Additionally, organizations should conduct comprehensive security assessments of their WordPress environments to identify similar vulnerabilities in other plugins or custom code implementations that might share comparable input handling patterns. The vulnerability underscores the critical importance of proper input validation and prepared statement usage in preventing SQL injection attacks within web applications.