CVE-2024-9658: School Management System Privilege Escalation

CVE-2024-9658 Overview

The School Management System for WordPress plugin developed by Dasinfomedia contains a privilege escalation vulnerability affecting all versions up to and including 93.0.0. The plugin fails to validate a user's identity before updating account details such as email and password through the mj_smgt_update_user() and mj_smgt_add_admission() functions. A local file inclusion weakness compounds the flaw. Authenticated attackers with student-level access or above can modify arbitrary user credentials, including those belonging to administrators, and hijack those accounts. The advisory notes the issue remains unpatched after vendor outreach.

Critical Impact
Any authenticated user with student role or higher can take over administrator accounts, resulting in full site compromise.

Affected Products

Dasinfomedia School Management System for WordPress — all versions ≤ 93.0.0
WordPress installations with the plugin activated
Sites exposing student-level registration or enrollment

Discovery Timeline

2025-03-07 - CVE-2024-9658 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9658

Vulnerability Analysis

The plugin exposes two functions, mj_smgt_update_user() and mj_smgt_add_admission(), that accept user identifiers and profile fields without confirming the requester owns the targeted account. An authenticated attacker submits a request specifying an arbitrary user_id, and the plugin updates the target's email address and password. Combined with a local file inclusion weakness [CWE-306, CWE-288], the attacker can pivot from a low-privileged student account to full administrative control. Once the administrator password is reset, the attacker logs in directly and inherits WordPress site-wide privileges, including plugin management, content modification, and PHP execution through theme or plugin editing.

Root Cause

The root cause is missing authentication for a critical function [CWE-306] and authentication bypass using an alternate path [CWE-288]. The vulnerable handlers trust client-supplied user identifiers instead of resolving the acting user from the WordPress session. No capability check (current_user_can()) or nonce verification gates the credential update path.

Attack Vector

Exploitation requires only a student-tier account, which many deployments allow through self-registration. The attacker sends a crafted POST request to the plugin's AJAX endpoint invoking mj_smgt_update_user() with an administrator's user_id and attacker-controlled email and password values. The plugin writes the new credentials, and the attacker completes the login. The local file inclusion component allows loading arbitrary PHP files within the plugin scope, expanding post-compromise options.

The vulnerability is described in prose only; no verified public proof-of-concept code is referenced in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-9658

Indicators of Compromise

Unexpected password reset or email change events on administrator accounts in the WordPress users table
POST requests to admin-ajax.php invoking actions tied to mj_smgt_update_user or mj_smgt_add_admission from low-privileged sessions
New administrator accounts created shortly after student-role logins
Plugin or theme file modifications following a suspicious login event

Detection Strategies

Audit WordPress user metadata for out-of-band email address changes on privileged accounts
Alert on AJAX requests that pass a user_id parameter mismatched with the requesting session's user ID
Correlate authentication events from new IP addresses against recently modified administrator accounts

Monitoring Recommendations

Enable WordPress audit logging for user profile updates, role changes, and login events
Forward web server access logs and PHP error logs to a centralized SIEM for correlation
Monitor file integrity on wp-content/plugins/school-management/ and administrator account attributes

How to Mitigate CVE-2024-9658

Immediate Actions Required

Deactivate and remove the School Management System for WordPress plugin until a fixed release is published
Reset passwords and rotate application passwords for all administrator and privileged accounts
Disable student self-registration or restrict it behind manual approval
Review the wp_users and wp_usermeta tables for unauthorized email or password changes

Patch Information

No vendor patch is available. The Wordfence Vulnerability Report states the issue was escalated after no vendor response. Users of the Codecanyon WordPress Plugin should verify with the vendor before reinstalling any version ≤ 93.0.0.

Workarounds

Remove the plugin entirely if the functionality is non-essential
Restrict access to admin-ajax.php endpoints associated with the plugin using web application firewall rules
Enforce multi-factor authentication on all WordPress administrator accounts to blunt credential replacement
Isolate the WordPress installation behind IP allow-lists for administrative routes

bash

# Example WAF rule concept: block plugin AJAX actions until removal is complete
# ModSecurity-style pseudo-rule
SecRule ARGS:action "@rx ^mj_smgt_(update_user|add_admission)$" \
    "id:1009658,phase:2,deny,status:403,\
    msg:'Block CVE-2024-9658 vulnerable plugin actions'"