60
CVE-2022-1609
PoC —CVSS 3.1
9.8 critical
EPSS
64%p99
Published
()
Modified
Description
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
- Vendors
- weblizar
- Products
- school management
- Ecosystems
- WordPress
- Weakness
- CWE-94
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H