CVE-2023-4776 WPSchoolPress < 2.2.5 - Teacher+ SQLi
Low-privilege users can exploit SQL injection in the School Management System plugin to read or modify database contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4776?
CVE-2023-4776 is a high-severity SQL injection vulnerability in Unknown School Management System, published on 16 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
Weakness: CWE-89
Which versions are affected by CVE-2023-4776?
It affects 1 product.
Products include Igexsolutions Wpschoolpress.
How do I fix CVE-2023-4776?
No fix has been published for CVE-2023-4776 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-4776 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4776 exists.
Other vulnerabilities in Unknown School Management System
- CVE-2025-1667 School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover
- CVE-2024-9637 Missing authorization in School Management System – WPSchoolPress
- CVE-2021-24575 WPSchoolPress < 2.1.10 - Multiple Authenticated SQL Injections
- CVE-2025-1669 School Management System – WPSchoolPress <= 2.2.17 - Authenticated (Teacher+) SQL Injection
- CVE-2025-1670 School Management System – WPSchoolPress <= 2.2.16 - Authenticated (Parent+) SQL Injection
Sources
Also known as GHSA-f7v3-rpm4-hwv2.