CVE-2025-1669

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1669", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-24T21:28:02.924Z", "datePublished": "2025-03-15T03:23:24.332Z", "dateUpdated": "2026-04-08T17:17:37.770Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:37.770Z"}, "affected": [{"vendor": "jdsofttech", "product": "School Management System \u2013 WPSchoolPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.17", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The School Management System \u2013 WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and including, 2.2.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with teacher-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "School Management System \u2013 WPSchoolPress <= 2.2.17 - Authenticated (Teacher+) SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7413d90-aed1-4f78-a17c-bed76efb48f8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/lib/wpsp-ajaxworks.php#L4304"}, {"url": "https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.18/lib/wpsp-ajaxworks.php#L4304"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "timeline": [{"time": "2025-11-05T19:39:04.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-03-14T14:22:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-17T21:25:20.889638Z", "id": "CVE-2025-1669", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T21:28:10.575Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1669", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-17T21:25:20.889638Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T21:25:22.124Z"}}], "cna": {"title": "School Management System \u2013 WPSchoolPress <= 2.2.17 - Authenticated (Teacher+) SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "jdsofttech", "product": "School Management System \u2013 WPSchoolPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.17"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-05T19:39:04.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-03-14T14:22:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7413d90-aed1-4f78-a17c-bed76efb48f8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/lib/wpsp-ajaxworks.php#L4304"}, {"url": "https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.18/lib/wpsp-ajaxworks.php#L4304"}], "descriptions": [{"lang": "en", "value": "The School Management System \u2013 WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and including, 2.2.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with teacher-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:37.770Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1669", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:17:37.770Z", "dateReserved": "2025-02-24T21:28:02.924Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-15T03:23:24.332Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "School Management System \u2013 WPSchoolPress", "vendor": "jdsofttech", "versions": [{"lessThanOrEqual": "2.2.17", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:igexsolutions:wpschoolpress:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "EF133B89-7064-447E-850F-3C5ED8C2AEB9", "versionEndIncluding": "2.2.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The School Management System \u2013 WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and including, 2.2.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with teacher-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El complemento School Management System \u2013 WPSchoolPress para WordPress, es vulnerable a la inyecci\u00f3n SQL mediante la acci\u00f3n \"addNotify\" en todas las versiones hasta la 2.2.16 incluida, debido a un escape insuficiente del par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n de la consulta SQL existente. Esto permite a atacantes autenticados, con acceso de profesor o superior, a\u00f1adir consultas SQL adicionales a las consultas existentes, que pueden utilizarse para extraer informaci\u00f3n confidencial de la base de datos."}], "id": "CVE-2025-1669", "lastModified": "2026-06-17T08:39:34.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1669", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-17T21:25:20.889638Z", "version": "2.0.3"}}]}, "published": "2025-03-15T04:15:21.630", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/lib/wpsp-ajaxworks.php#L4304"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.18/lib/wpsp-ajaxworks.php#L4304"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7413d90-aed1-4f78-a17c-bed76efb48f8?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:33:52.999408+00:00", "value": {"mitigation_remediation": ["Upgrade WPSchoolPress to version 2.2.18 or later, which includes proper input sanitization for the addNotify action", "Restrict teacher accounts to the minimum necessary permissions and audit their access levels regularly", "Implement application\u2011level request filtering to block malformed SQL payloads in the addNotify endpoint", "Use database parameter binding if custom queries are added, ensuring that all user input is properly escaped"], "summary": {"action": "Patch immediately", "impact": "SQL Injection allowing extraction of sensitive database information"}, "threat_synthesis": {"affected_systems": "WordPress installations running the jdsofttech School Management System \u2013 WPSchoolPress plugin up to and including version 2.2.17. The affected code resides in the plugin\u2019s lib/wpsp-ajaxworks.php file. Users of any WordPress instance that has installed this plugin within the specified version range are susceptible.", "description_and_impact": "The WPSchoolPress plugin for WordPress contains an unescaped parameter in the 'addNotify' action, which permits an authenticated user with teacher or higher privileges to inject arbitrary SQL into the backend query. This leads to the ability to read or modify data exposed in the database, constituting a data exfiltration vulnerability. The flaw is classified as CWE-89, reflecting improper constraint or sanitization of SQL input.", "risk_and_exploitability": "The issue has a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1%, implying a very low but non\u2011zero exploitation probability. It is not currently listed in the CISA KEV catalog. The most likely attack path requires the attacker to first log in as a teacher or higher role, then target the addNotify endpoint via the web interface or API. Once authenticated, the attacker can embed malicious SQL fragments that the plugin concatenates into a larger query, enabling data retrieval or modification."}}}}, "created": "2026-04-20T23:45:21.601892+00:00", "updated": "2026-04-20T23:45:21.601904+00:00", "vendors": []}