The School Management System for WordPress plugin by dasinfomedia suffers from an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. Multiple AJAX endpoints accept user input without adequate escaping or prepared statements, enabling attackers without authentication to inject additional SQL queries. This vulnerability affects all plugin versions up to and including 93.2.0 and can be exploited to extract sensitive data from the backend database. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity and no privileges required, impacting confidentiality but not integrity or availability.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability impacts confidentiality but does not affect integrity or availability. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting access to the affected plugin and monitor for updates from dasinfomedia. Applying web application firewall (WAF) rules that detect and block SQL Injection attempts may provide temporary mitigation.