CVE-2024-12612: WordPress School Management SQL Injection

CVE-2024-12612 Overview

CVE-2024-12612 is a SQL Injection vulnerability in the School Management System for WordPress plugin. The flaw affects all versions up to and including 93.2.0. Multiple AJAX action parameters fail to properly escape user-supplied input before incorporating it into SQL queries. Unauthenticated attackers can append additional SQL statements to existing queries and extract sensitive data from the database.

The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). No authentication is required, and the attack can be executed remotely over the network.

Critical Impact
Unauthenticated remote attackers can extract sensitive information from the WordPress database, including user credentials, student records, and other stored data managed by the plugin.

Affected Products

School Management System for WordPress plugin — all versions up to and including 93.2.0
WordPress installations with the vulnerable plugin active
Sites distributed via CodeCanyon listing for the plugin

Discovery Timeline

2025-08-16 - CVE-2024-12612 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12612

Vulnerability Analysis

The plugin exposes multiple AJAX endpoints that accept user-supplied parameters and incorporate them directly into SQL queries. The code does not apply sufficient escaping, and prepared statements are not consistently used. As a result, attacker-controlled input reaches the database engine as executable SQL.

Because the vulnerable AJAX actions are reachable without authentication, any remote attacker who can send HTTP requests to the WordPress site can attempt exploitation. The CWE-89 classification reflects the absence of parameter binding and the reliance on string concatenation when constructing SQL statements.

The attack surface includes several distinct AJAX actions and parameters, increasing the likelihood that automated scanners will discover and exploit the issue across exposed sites.

Root Cause

The root cause is twofold. First, user-supplied parameters are inserted into SQL queries without proper escaping using functions such as esc_sql() or wpdb::prepare(). Second, the existing query construction does not use parameter placeholders, allowing input to alter query structure rather than serving only as data.

Attack Vector

An attacker sends a crafted HTTP request to the WordPress site targeting one of the vulnerable AJAX endpoints. The request includes SQL syntax in one of the affected parameters. The injected SQL is appended to the original query, enabling UNION-based or boolean-based extraction of database contents. No user interaction or prior authentication is needed.

No verified public proof-of-concept code is referenced in the available advisory data. Refer to the Wordfence Vulnerability Report for technical specifics on the affected parameters and AJAX actions.

Detection Methods for CVE-2024-12612

Indicators of Compromise

Unexpected admin-ajax.php requests containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA
High volumes of POST requests to admin-ajax.php with the plugin's AJAX action names
Database error messages in PHP error logs referencing malformed queries
Anomalous outbound data flows from the web host following AJAX requests

Detection Strategies

Inspect web server access logs for AJAX requests containing SQL metacharacters such as single quotes, comments (--, #), or stacked statement separators
Deploy a web application firewall ruleset that flags SQL Injection signatures targeting WordPress AJAX endpoints
Correlate spikes in admin-ajax.php traffic with subsequent database read latency or large response payloads

Monitoring Recommendations

Enable WordPress debug logging and forward wp-content/debug.log entries to a central log store
Monitor MySQL/MariaDB slow query and general query logs for queries containing suspicious UNION SELECT patterns
Alert on unauthenticated requests that produce database errors or unusually large response bodies

How to Mitigate CVE-2024-12612

Immediate Actions Required

Deactivate the School Management System for WordPress plugin until a fixed version is installed
Restrict access to admin-ajax.php from untrusted networks via WAF or reverse proxy rules
Rotate WordPress administrator credentials and any database credentials reachable through the plugin
Review recent access logs for prior exploitation attempts and audit database contents for unauthorized access

Patch Information

No fixed version is identified in the available advisory data at the time of publication. Site operators should monitor the CodeCanyon product page and the Wordfence advisory for vendor updates. Apply the patched release as soon as it becomes available.

Workarounds

Place the WordPress site behind a web application firewall with SQL Injection signatures enabled
Use a plugin-level access control to block unauthenticated calls to the vulnerable AJAX actions
Restrict database user privileges so the WordPress account cannot read tables outside the plugin's scope
Take a verified backup of the database and file system before applying any remediation

bash

# Example: temporarily block the vulnerable plugin's AJAX endpoint via nginx
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^(sms_|school_management_)") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}