CVE-2025-1669
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Published Mar 15, 2025
Updated: Mar 28, 2025
CWE ID 89
Summary
CVE-2025-1669 is a vulnerability affecting the WPSchoolPress plugin for WordPress. This issue allows authenticated attackers with teacher-level access and above to execute SQL Injections through the 'addNotify' action. The vulnerability arises due to insufficient escaping on user-supplied parameters and the absence of proper preparation of SQL queries, resulting in the attacker being able to append additional SQL queries to existing ones. This can potentially lead to the extraction of sensitive information from the database.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.