Unrated severityNVD Advisory· Published Jan 16, 2024· Updated Jun 2, 2025
The School Management < 9.9.7 - Unauthenticated RCE via REST api
CVE-2022-1609
Description
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <9.9.7
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/e2d546c9-85b6-47a4-b951-781b9ae5d0f2/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.