CVE-2025-6079: School Management System WordPress RCE Flaw

CVE-2025-6079 Overview

CVE-2025-6079 is an arbitrary file upload vulnerability in the School Management System for WordPress plugin. The flaw exists in the homework.php file and affects all versions up to and including 93.2.0. The plugin fails to validate file types during homework submission, allowing authenticated users with Student-level access or higher to upload arbitrary files to the server. Successful exploitation can lead to remote code execution on the affected site. The issue is tracked under [CWE-434] Unrestricted Upload of File with Dangerous Type. CVE-2025-31100 is potentially a duplicate of this vulnerability.

Critical Impact
Authenticated attackers with Student-level privileges can upload arbitrary files to the web server, enabling remote code execution and full site compromise.

Affected Products

School Management System for WordPress plugin, all versions through 93.2.0
WordPress sites running the vulnerable plugin with student or higher-level user registration enabled
Distributed via Codecanyon as a commercial WordPress plugin

Discovery Timeline

2025-08-16 - CVE-2025-6079 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-6079

Vulnerability Analysis

The vulnerability resides in homework.php, a component intended to handle homework file submissions by authenticated student users. The plugin accepts uploaded files without enforcing an allowlist of acceptable file extensions or validating MIME types against expected content. As a result, attackers can submit executable server-side scripts, such as PHP files, in place of legitimate homework documents.

Once uploaded, the malicious file is written to a location accessible via the web server. The attacker can then request the file directly to trigger PHP execution under the privileges of the web server process. This converts a feature intended for low-privilege coursework submissions into a path to full code execution on the host.

The attack requires authentication at the Student role or above. Because many deployments of this plugin enable open student registration, the authentication barrier is low in practice.

Root Cause

The root cause is missing file type validation in the homework upload handler. The plugin does not verify file extensions, MIME types, or magic bytes before writing uploads to disk. This is a textbook instance of [CWE-434] Unrestricted Upload of File with Dangerous Type.

Attack Vector

An authenticated attacker submits a crafted multipart upload through the homework submission interface. The payload contains a PHP webshell or other server-executable file. After the file is stored in the plugin's upload directory, the attacker issues an HTTP request to the uploaded path. The web server executes the file, granting the attacker arbitrary command execution within the WordPress site context. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-6079

Indicators of Compromise

Files with executable extensions such as .php, .phtml, .phar, or .htaccess present in homework or student submission directories
Outbound network connections initiated by the www-data or PHP-FPM process to unfamiliar external hosts
New or modified WordPress administrator accounts that did not result from legitimate provisioning
Web server access logs showing direct GET or POST requests to files inside the plugin's upload directory

Detection Strategies

Audit the file system for non-document file types within the School Management System upload paths
Inspect WordPress access logs for POST requests to homework.php followed by GET requests to newly created files in writable directories
Correlate file creation events under wp-content/ with subsequent PHP process executions to surface webshell activity

Monitoring Recommendations

Alert on creation of files with server-executable extensions inside any WordPress uploads directory
Monitor PHP processes for anomalous child processes such as sh, bash, curl, wget, or python
Track authenticated session activity from Student-role accounts that interact with file upload endpoints

How to Mitigate CVE-2025-6079

Immediate Actions Required

Disable the School Management System for WordPress plugin until a vendor-supplied patch is applied
Restrict new student account registration and review existing Student-role accounts for unfamiliar entries
Scan plugin upload directories for unauthorized files and remove any server-executable content
Rotate WordPress administrator credentials and secret keys if compromise is suspected

Patch Information

At the time of NVD publication, no fixed version is identified in the available references. Administrators should consult the vendor listing on Codecanyon and the Wordfence Vulnerability Report for updated remediation guidance and apply a patched release as soon as one is published.

Workarounds

Configure the web server to deny PHP execution within the WordPress uploads directory using .htaccess rules or equivalent Nginx location blocks
Place a web application firewall in front of the site with rules that block uploads containing PHP shebangs or executable extensions
Limit user registration to trusted users only and disable self-service Student registration where possible

bash

# Apache: deny PHP execution in WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php5|php7|pht)$">
    Require all denied
</FilesMatch>