The School Management System for WordPress plugin by dasinfomedia suffers from a missing capability check (CWE-862) on the 'mj_smgt_remove_feetype' and 'mj_smgt_remove_category_new' AJAX actions. This flaw permits unauthenticated users to invoke these actions and delete arbitrary posts, leading to unauthorized data loss. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. No patch or remediation details are currently provided, and no known exploits in the wild have been reported.

An attacker without authentication can delete arbitrary posts via vulnerable AJAX endpoints, resulting in unauthorized data loss. There is no indication of confidentiality or availability impact beyond integrity loss. The vulnerability could disrupt normal plugin operation by removing critical data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable AJAX endpoints if possible or disable the plugin to prevent exploitation.