CVE-2025-11981 is an SQL Injection vulnerability in the School Management System – WPSchoolPress WordPress plugin affecting all versions up to 2.2.23. The issue arises from insufficient escaping and lack of proper preparation of the 'SCodes' parameter in SQL queries. Authenticated attackers with administrator privileges can exploit this to append malicious SQL commands to existing queries, potentially extracting sensitive data from the database. The vulnerability is classified under CWE-89 and has a CVSS v3.1 base score of 4.9 (medium severity). No known exploits in the wild or patch links are currently available.

An attacker with administrator-level access can exploit this vulnerability to perform SQL Injection attacks, enabling unauthorized extraction of sensitive information from the database. The vulnerability does not impact availability or integrity according to the CVSS vector but compromises confidentiality. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'SCodes' parameter. Avoid using affected versions of the plugin in sensitive environments if possible.