School Management System Plugin up to 1.93.1/93.1.0 on WordPress Password Update page file inclusion

Summaryinfo

A vulnerability was found in School Management System Plugin up to 1.93.1/93.1.0 on WordPress. It has been rated as problematic. The impacted element is an unknown function of the component Password Update Handler. Performing a manipulation of the argument page results in file inclusion. This vulnerability is known as CVE-2025-3740. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in School Management System Plugin up to 1.93.1/93.1.0 on WordPress. This affects an unknown function of the component Password Update Handler. The manipulation of the argument page with an unknown input leads to a file inclusion vulnerability. CWE is classifying the issue as CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 93.1.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The Local File Inclusion exploit can be chained to include various dashboard view files in the plugin. One such chain can be leveraged to update the password of Super Administrator accounts in Multisite environments making privilege escalation possible. The vendor has updated the version numbers beginning with `1.93.1 (02-07-2025)` for the patched version. This version comes after version 93.1.0.

The advisory is shared at wordfence.com. This vulnerability is uniquely identified as CVE-2025-3740 since 04/16/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation requires an enhanced level of successful authentication. Technical details are known, but no exploit is available.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-21843). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Customer Relationship Management System

Name

• School Management System Plugin

Version

• 1.93.0
• 1.93.1
• 93.0
• 93.1.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion