CVE-2025-47572: School Management LFI Vulnerability

CVE-2025-47572 Overview

CVE-2025-47572 is a PHP Local File Inclusion (LFI) vulnerability in the mojoomla School Management plugin for WordPress. The flaw stems from improper control of filenames passed to PHP include or require statements, classified under [CWE-98]. Attackers with low-privilege authenticated access can manipulate file path parameters to load arbitrary local PHP files. The vulnerability affects all versions of School Management from initial release through version 93.0.0. Successful exploitation can lead to sensitive data disclosure, source code exposure, and in some configurations remote code execution through log poisoning or session file inclusion.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to information disclosure and potential code execution within the WordPress environment.

Affected Products

mojoomla School Management plugin for WordPress
Versions from initial release through 93.0.0
WordPress installations with the vulnerable plugin enabled

Discovery Timeline

2025-06-17 - CVE-2025-47572 published to the National Vulnerability Database
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-47572

Vulnerability Analysis

The vulnerability resides in PHP code that constructs file paths from user-controllable input and passes them directly to include, require, include_once, or require_once statements. The plugin fails to validate or sanitize the filename parameter against an allowlist of expected files. Attackers can supply path traversal sequences or absolute paths to access files outside the intended directory. The attack requires network access and low-privilege authentication on the WordPress site. Exploitation yields high impact across confidentiality, integrity, and availability when chained with writable log locations or session files.

Root Cause

The root cause is improper neutralization of filename input used in PHP file inclusion functions [CWE-98]. The plugin treats request parameters such as page identifiers or module names as trusted strings. Without canonicalization or allowlist validation, traversal sequences like ../ resolve to arbitrary filesystem locations. PHP then loads and executes the targeted file as code.

Attack Vector

The attack vector is network-based through standard HTTP requests to vulnerable plugin endpoints. An authenticated user submits a crafted parameter referencing a local file path. The PHP interpreter resolves the path and includes the file content. Common targets include WordPress configuration files, log files containing attacker-injected PHP payloads, and PHP session files. The attack complexity is elevated because the attacker must identify the vulnerable parameter and bypass any partial filtering present in the plugin.

For technical specifics, see the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-47572

Indicators of Compromise

HTTP requests containing path traversal sequences such as ../, ..\, or URL-encoded variants like %2e%2e%2f targeting School Management plugin endpoints
Web server access log entries referencing plugin paths under /wp-content/plugins/school-management/ with suspicious query parameters
Unexpected PHP errors in WordPress debug logs referencing failed include or require calls
Access to sensitive files such as wp-config.php, /etc/passwd, or PHP session storage directories from web processes

Detection Strategies

Inspect web application firewall logs for path traversal patterns in requests to school-management plugin URIs
Correlate authenticated WordPress sessions with anomalous parameter values containing filesystem path characters
Monitor file access telemetry on the web server for PHP processes reading files outside the WordPress plugin directory
Review PHP error logs for failed to open stream warnings that indicate inclusion attempts

Monitoring Recommendations

Enable verbose access logging on WordPress sites running the School Management plugin
Forward web server and PHP-FPM logs to a centralized analytics platform for correlation
Alert on outbound network traffic from PHP processes that may indicate post-exploitation activity
Track plugin version inventory across managed WordPress installations to identify unpatched instances

How to Mitigate CVE-2025-47572

Immediate Actions Required

Identify all WordPress installations running the mojoomla School Management plugin and confirm installed versions
Disable the School Management plugin on any site running version 93.0.0 or earlier until a patched release is verified
Restrict access to the WordPress administrative area to trusted IP ranges to limit authenticated exploitation
Audit existing user accounts on affected sites for unauthorized privilege changes

Patch Information

No patched version is referenced in the current advisory data. Monitor the Patchstack advisory and the mojoomla vendor channels for an updated release. Apply the fix immediately once published and verify the plugin version is greater than 93.0.0.

Workarounds

Deploy web application firewall rules that block path traversal sequences and absolute path references in requests to the School Management plugin
Configure PHP open_basedir to restrict file inclusion to the WordPress document root and required system directories
Set allow_url_include to Off in php.ini to prevent remote inclusion vectors if the parameter is reachable
Remove write permissions from log directories and session storage paths used by the web server to limit log poisoning chains

bash

# Example php.ini hardening to limit file inclusion scope
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"