CVE-2026-9767
Received Received - Intake

SQL Injection in School Management ERP WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is replicated across seven or more AJAX handlers including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments, and the missing nonce verification on several of these handlers also enables CSRF-chained exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-9767
EUVD
EUVD-2026-59904

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
school_management education_learning_erp to 5.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL Injection flaw in the School Management – Education & Learning ERP WordPress plugin. It allows authenticated attackers with custom-level access or higher to inject malicious SQL queries via the 'order[0][dir]' parameter. The plugin fails to properly escape user input and lacks sufficient SQL query preparation, enabling attackers to extract sensitive database information.

Detection Guidance

This vulnerability can be detected by checking for SQL injection attempts in the parameters of the affected AJAX handlers. Monitor logs for unusual queries containing 'order[0][dir]' or suspicious patterns in requests to endpoints like wlsm-fetch-staff-classes, wlsm-fetch-notices, or wlsm-fetch-subjects. Use tools like grep to search for these patterns in web server logs.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal sensitive data from your WordPress database, such as user credentials, personal information, or financial records. Since it affects multiple AJAX handlers and lacks nonce verification on some, it could also be chained with CSRF attacks to increase the risk of compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and security. Organizations using this plugin may face compliance violations, legal penalties, and reputational damage if sensitive data is exposed due to this flaw.

Mitigation Strategies

Immediately update the School Management – Education & Learning ERP plugin to the latest version beyond 5.4. Disable or restrict access to the vulnerable AJAX handlers if an update is not immediately available. Implement WAF rules to block SQL injection attempts and ensure proper input validation and output encoding are in place.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9767. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart