CVE-2023-4776 — WPSchoolPress < 2.2.5 - Teacher+ SQLi
The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading …
Published: 2023-10-16 · CVSS: 8.8 · CVSS 3.1
The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7