CVE-2025-11981: WPSchoolPress SQL Injection Vulnerability

CVE-2025-11981 Overview

CVE-2025-11981 is an authenticated SQL injection vulnerability in the School Management System – WPSchoolPress plugin for WordPress. The flaw affects all versions up to and including 2.2.23. It stems from insufficient escaping of the SCodes parameter and inadequate preparation of the underlying SQL query. Authenticated attackers with administrator-level access or above can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated administrators can execute arbitrary SQL queries against the WordPress database and exfiltrate stored credentials, user data, and other confidential records.

Affected Products

School Management System – WPSchoolPress plugin for WordPress
All versions up to and including 2.2.23
WordPress installations with WPSchoolPress activated

Discovery Timeline

2025-11-14 - CVE-2025-11981 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11981

Vulnerability Analysis

The vulnerability resides in the WPSchoolPress AJAX handling logic implemented in wpsp-ajaxworks.php. The plugin accepts a user-supplied SCodes parameter and concatenates it into an SQL statement without sufficient escaping or use of prepared statements. This creates a classic in-band SQL injection primitive where attacker-controlled input alters query semantics. Because the injection point sits inside an already-formed SQL query, adversaries can append UNION SELECT clauses or stacked subqueries to retrieve arbitrary data from the WordPress schema, including the wp_users table.

Root Cause

The root cause is a failure to use the WordPress $wpdb->prepare() API with proper placeholders. The SCodes parameter reaches the query builder without sanitization through esc_sql() or parameterized binding. When the SQL statement executes, MySQL interprets injected metacharacters as query syntax rather than literal data. The relevant code paths are visible in the WPSchoolPress source at line 1844 and line 1872.

Attack Vector

Exploitation requires a valid authenticated session with administrator-level privileges on the target WordPress site. The attacker submits a crafted request to the vulnerable AJAX endpoint, injecting SQL syntax through the SCodes parameter. Because the vulnerability is network-reachable and requires no user interaction beyond the attacker's own authenticated session, it is well-suited for post-compromise data exfiltration or lateral impact by rogue administrators. See the Wordfence Vulnerability Report for additional detail.

No verified public proof-of-concept code is available. Refer to the vendor changeset for the patched query construction pattern.

Detection Methods for CVE-2025-11981

Indicators of Compromise

Unexpected POST requests to WPSchoolPress AJAX handlers containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the SCodes parameter.
MySQL slow query log entries showing anomalous SELECT statements originating from the WPSchoolPress code path.
Unusual data reads from the wp_users or wp_usermeta tables outside normal administrative workflows.

Detection Strategies

Enable WordPress debug logging and query logging to capture the full SQL executed by WPSchoolPress endpoints.
Deploy Web Application Firewall (WAF) signatures that inspect request bodies for SQL metacharacters in the SCodes parameter.
Correlate administrator authentication events with subsequent database read volume spikes to identify credential abuse.

Monitoring Recommendations

Audit administrator account activity, particularly newly created or recently elevated accounts, for unexpected plugin AJAX calls.
Alert on outbound HTTP traffic from the web server that follows administrator database interactions, which may indicate exfiltration.
Track plugin version inventory across managed WordPress sites and flag installations still running WPSchoolPress 2.2.23 or earlier.

How to Mitigate CVE-2025-11981

Immediate Actions Required

Update the School Management System – WPSchoolPress plugin to a version newer than 2.2.23 as soon as a fixed release is available.
Review the WordPress administrator user list and remove or rotate credentials for any account that is not strictly required.
Enforce multi-factor authentication for all administrator accounts to reduce the risk of credential-based exploitation.

Patch Information

The upstream fix is committed in the plugin repository. Review the WordPress plugin changeset 3389346 for the code changes that introduce proper query preparation. Site owners should upgrade to the latest available WPSchoolPress release that includes this changeset.

Workarounds

Deactivate the WPSchoolPress plugin until the patched version is installed if the school management functionality is not business-critical.
Restrict administrator dashboard access by IP allowlisting at the reverse proxy or WAF layer to limit exposure of vulnerable AJAX endpoints.
Apply virtual patching rules in the WAF to block requests containing SQL syntax in the SCodes parameter targeting admin-ajax.php.

bash

# Example WAF rule (ModSecurity) to block SQL syntax in SCodes parameter
SecRule ARGS:SCodes "@rx (?i)(union(\s|/\*.*\*/)+select|information_schema|sleep\s*\(|benchmark\s*\()" \
    "id:1011981,phase:2,deny,status:403,log,msg:'CVE-2025-11981 WPSchoolPress SCodes SQLi attempt'"