The vulnerability identified as CVE-2024-12332 affects the WPSchoolPress plugin for WordPress, a school management system developed by jdsofttech. The issue stems from improper neutralization of special elements in SQL commands (CWE-89), specifically through the 'cid' parameter, which is insufficiently escaped and lacks prepared statements. This allows authenticated users with relatively low privileges (Student/Parent-level and above) to append additional SQL queries to existing database queries. Exploiting this flaw can lead to unauthorized extraction of sensitive information from the backend database, such as student records or administrative data. The vulnerability does not require administrative privileges or user interaction, increasing its risk profile. The CVSS v3.1 base score is 6.5, reflecting a medium severity with high confidentiality impact but no impact on integrity or availability. The attack vector is network-based with low attack complexity and requires privileges but no user interaction. No patches or known exploits have been reported at the time of publication, but the vulnerability is publicly disclosed and should be addressed promptly.

The primary impact of this vulnerability is the potential unauthorized disclosure of sensitive information stored in the WPSchoolPress database, including student data, grades, attendance, and possibly personal identifiable information. Since the vulnerability can be exploited by users with Student/Parent-level access, attackers do not need administrative credentials, broadening the scope of potential attackers. This can lead to privacy violations, regulatory non-compliance (e.g., FERPA in the US, GDPR in Europe), reputational damage, and potential legal consequences for educational institutions. Although the vulnerability does not allow data modification or denial of service, the confidentiality breach alone can have severe consequences, especially in educational environments where data sensitivity is high. The lack of known exploits reduces immediate risk but does not eliminate the threat, as attackers may develop exploits following public disclosure.

Organizations should immediately upgrade the WPSchoolPress plugin to a version that addresses this vulnerability once available. In the absence of an official patch, administrators should implement strict input validation and sanitization on the 'cid' parameter, ideally using parameterized queries or prepared statements to prevent SQL injection. Restricting user privileges further, for example by limiting Student/Parent-level access to only necessary functionality, can reduce exploitation risk. Employing Web Application Firewalls (WAFs) with SQL injection detection rules can provide temporary protection. Regularly auditing database access logs for unusual query patterns may help detect exploitation attempts. Additionally, organizations should ensure that backups are maintained securely and that sensitive data is encrypted at rest to mitigate data exposure risks. Finally, educating users about the risks and monitoring plugin updates from jdsofttech is critical for long-term security.