PT-2025-29986 · WordPress · School Management System For Wordpress

Thái An · Published 2025-07-18 · Updated 2025-07-22 · CVE-2025-3740

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions School Management System for Wordpress plugin for WordPress versions prior to 93.1.0

Description The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion via the page parameter. This allows authenticated attackers with Subscriber-level access and above to include and execute arbitrary files on the server, potentially enabling the execution of PHP code. This can be used to bypass access controls, obtain sensitive data, or achieve code execution. Privilege escalation is possible in Multisite environments by updating Super Administrator passwords.

Recommendations Update to version 93.1.0 or later.

Fix

LPE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-3740

Affected Products

School Management System For Wordpress

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-3740 · Security Note
• https://t.me/cvenotify/129399 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1946098838671949914 · Twitter Post
• https://twitter.com/CveFindCom/status/1946067615182365180 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3604aece-5e76-4e8e-9caf-f518d6001277?source=cve · Note
• https://twitter.com/CVEnew/status/1946078250981044656 · Twitter Post
• https://t.me/cvetracker/28095 · Telegram Post
• https://t.me/cvenotify/129802 · Telegram Post
• https://t.me/cveNotify/129802 · Telegram Post
• https://codecanyon.net/item/school-management-system-for-wordpress/11470032#item-description__update-history · Note