CVE-2024-12332

Summary

CVE-2024-12332: The WPSchoolPress plugin for WordPress, used in School Management Systems, is affected by an SQL Injection vulnerability. Authenticated attackers with Student/Parent-level access or higher can exploit this issue by adding malicious SQL queries to the 'cid' parameter. This allows them to extract sensitive information from the database by manipulating existing queries, putting sensitive data at risk. Versions up to and including 2.2.14 are vulnerable to this issue, which arises from insufficient escaping of user-supplied data and a lack of query preparation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.