Description

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is replicated across seven or more AJAX handlers including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments, and the missing nonce verification on several of these handlers also enables CSRF-chained exploitation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-16T06:16:55.133Z",
  "pubdate": "2026-08-16T06:16:55.133Z",
  "executiveSummary": "The School Management – Education & Learning ERP plugin for WordPress suffers from a generic SQL Injection vulnerability affecting all versions up to, and including, 5.4. The security flaw stems from insufficient escaping applied to the user-supplied parameter 'order[0][dir]' and a lack of proper parameterization within existing database queries across multiple AJAX handlers. This vulnerability allows authenticated attackers with custom-level access and above to manipulate database queries, leading to the extraction of sensitive information from the underlying database. Furthermore, several of the affected AJAX handlers lack proper nonce verification, thereby enabling Cross-Site Request Forgery (CSRF)-chained exploitation vectors. The risk implications include unauthorized database access, potential data exfiltration, and compromised application integrity. Remediation requires robust input sanitization, parameterized query implementation, and strict cryptographic nonce validation across all vulnerable AJAX endpoints.",
  "technicalDetails": "The vulnerability is classified as a generic SQL Injection flaw residing in the School Management – Education & Learning ERP plugin for WordPress across all versions up to, and including, 5.4. The root cause of the vulnerability is the absence of adequate input sanitization and escaping on the user-supplied 'order[0][dir]' parameter combined with a failure to utilize prepared statements within the application's SQL query construction logic. This flaw is systematically replicated across seven or more AJAX handlers, specifically including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments. Attack vector requirements dictate that the attacker possesses at least authenticated custom-level access to interact with the targeted AJAX endpoints. However, the absence of nonce verification on several of these vulnerable handlers introduces an additional attack surface, permitting CSRF-chained exploitation where an external malicious site can force an authenticated privileged user to execute the injected database queries unknowingly. During exploitation, an attacker submits a crafted HTTP request targeting one of the vulnerable AJAX handlers, injecting malicious SQL payloads directly into the 'order[0][dir]' parameter. Because the input is insufficiently escaped and directly concatenated or interpolated into the existing SQL query without proper query preparation, the database engine interprets the injected payload as executable SQL syntax. This enables the attacker to append arbitrary SQL commands to the existing query structure, manipulate the result sets, and bypass intended data access controls. The post-exploitation impact includes the systematic extraction of sensitive information stored within the WordPress database, potentially exposing confidential institutional data, user records, and operational details."
}