CVE-2025-1667 is an authorization bypass vulnerability in the School Management System – WPSchoolPress WordPress plugin. The issue arises from the absence of proper capability checks in the wpsp_UpdateTeacher() function, allowing authenticated users with teacher-level privileges or above to modify arbitrary user details such as email addresses. This can lead to privilege escalation by enabling attackers to request password resets and take over accounts, including those with administrative rights. The vulnerability affects all versions up to and including 2.2.16. No official patch or remediation link is currently provided.

Successful exploitation allows authenticated users with teacher-level access or higher to escalate privileges by modifying user details and resetting passwords. This can lead to full compromise of administrative accounts and complete control over the affected WordPress installation running the vulnerable plugin. The impact includes confidentiality, integrity, and availability loss as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict teacher-level access to trusted users only and monitor for suspicious activity related to user detail changes and password reset requests. Consider disabling or removing the WPSchoolPress plugin if possible to reduce exposure.