CVE-2024-12470 is a critical vulnerability in the School Management System – SakolaWP WordPress plugin (up to version 1.0.8) caused by improper privilege assignment (CWE-266). The registration function does not properly restrict the roles that a new user can register as, enabling unauthenticated attackers to create accounts with administrative privileges. This vulnerability allows complete control over the affected system, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, reflecting the ease of exploitation and severe impact. No patch or official fix has been documented in the provided data, and the product is not a cloud service, so remediation depends on vendor updates or user intervention.

Successful exploitation allows unauthenticated attackers to register as administrative users, granting full control over the WordPress site running the vulnerable plugin. This compromises confidentiality, integrity, and availability of the system, potentially leading to complete takeover, data theft, or site disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting registration functionality to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.