CVE-2025-15656: Mojoomla School Management Escalation

CVE-2025-15656 Overview

CVE-2025-15656 is an Incorrect Privilege Assignment vulnerability [CWE-266] in the Mojoomla School Management plugin for WordPress. The flaw allows an authenticated attacker to escalate privileges within the application. All versions through 93.2.0 are affected. The issue carries a CVSS 3.1 score of 8.8, with a network attack vector and low privilege requirements.

Critical Impact
An authenticated low-privilege user can escalate to administrator on WordPress sites running the Mojoomla School Management plugin, leading to full site compromise.

Affected Products

Mojoomla School Management plugin for WordPress
All versions from n/a through 93.2.0
WordPress sites with the plugin enabled

Discovery Timeline

2026-06-03 - CVE CVE-2025-15656 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2025-15656

Vulnerability Analysis

The vulnerability stems from incorrect privilege assignment within the School Management plugin's user role handling logic. An authenticated user with limited permissions can manipulate role or capability assignments and gain higher privileges than intended. Because the attack vector is network-based and requires only low privileges with no user interaction, exploitation can be carried out remotely against any account on a vulnerable site.

The impact spans confidentiality, integrity, and availability. A successful privilege escalation produces administrator-level access, exposing all stored data, allowing modification of site content and configuration, and enabling full takeover including plugin and theme installation. School Management plugins typically register multiple roles such as student, teacher, parent, and administrator, expanding the population of accounts an attacker can leverage as a starting point.

Refer to the Patchstack Vulnerability Advisory for advisory details.

Root Cause

The root cause is Incorrect Privilege Assignment [CWE-266]. The plugin assigns privileges to a user without correctly validating the requester's authority to receive or grant those privileges. Insufficient capability checks in role or profile update workflows enable the unauthorized assignment.

Attack Vector

An attacker authenticates to the WordPress site with any low-privilege role registered by the plugin. The attacker then issues a crafted request to the vulnerable endpoint that performs the privilege change. Because the endpoint fails to verify the caller's capability to assign that role, the privilege escalation succeeds without user interaction. No verified public exploit code is currently available, and no realCodeExamples were provided for this CVE.

// No verified exploit code available.
// See the Patchstack advisory linked above for technical details.

Detection Methods for CVE-2025-15656

Indicators of Compromise

Unexpected promotion of accounts to administrator or other privileged WordPress roles in the wp_usermeta table.
New administrator accounts created from sessions of previously low-privilege users.
Installation of unfamiliar plugins or themes shortly after a non-admin user logs in.
Modifications to wp-config.php or appearance of webshell files within wp-content/uploads.

Detection Strategies

Audit WordPress role and capability changes by monitoring wp_usermeta rows where meta_key = 'wp_capabilities'.
Review access logs for authenticated requests to School Management plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/ paths.
Correlate login events for low-privilege users with subsequent administrative actions in the same session.

Monitoring Recommendations

Enable a WordPress activity log that records role changes, user creation, and plugin installations.
Alert on any role elevation event originating from a non-administrator account.
Track HTTP POST requests to plugin endpoints associated with profile or role updates.

How to Mitigate CVE-2025-15656

Immediate Actions Required

Update the Mojoomla School Management plugin to a version newer than 93.2.0 once the vendor releases a fix.
Audit all WordPress user accounts and revoke any unauthorized administrator privileges.
Reset passwords for all privileged accounts and rotate WordPress secret keys in wp-config.php.
Review installed plugins, themes, and uploaded files for signs of post-exploitation persistence.

Patch Information

At the time of NVD publication on 2026-06-03, the advisory lists all versions through 93.2.0 as affected. Consult the Patchstack Vulnerability Advisory for the most current patched version and remediation status.

Workarounds

Deactivate the School Management plugin until a patched version is installed.
Restrict registration of new accounts and require administrator approval for role changes.
Place the WordPress administrative interface behind a web application firewall with virtual patching rules for the plugin's vulnerable endpoints.
Limit access to /wp-admin/ by IP allowlist where operationally feasible.

bash

# Temporarily disable the plugin via WP-CLI until a patch is applied
wp plugin deactivate school-management

# Identify users elevated to administrator
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered