CVE-2024-9637 affects the School Management System – WPSchoolPress WordPress plugin up to version 2.2.10. The vulnerability arises because the plugin does not properly validate a user's identity before allowing updates to user details such as email addresses. Authenticated users with teacher-level privileges or higher can exploit this to change any user's email address, including administrators, enabling them to reset passwords and gain unauthorized access to those accounts. This is an authorization bypass vulnerability categorized under CWE-639. The CVSS 3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated attacker with teacher-level access or above to take over arbitrary user accounts, including administrators, by changing their email addresses and resetting their passwords. This leads to full compromise of affected accounts, potentially resulting in complete control over the WordPress site managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict teacher-level and higher privileges to trusted users only. Monitor for plugin updates from jdsofttech and apply any official patches promptly once available.