CVE-2025-1668 is a missing authorization vulnerability (CWE-862) in the WPSchoolPress plugin for WordPress, affecting all versions up to 2.2.16. The vulnerability arises because the wpsp_DeleteUser() function does not perform a capability check, allowing authenticated users with teacher-level privileges or above to delete arbitrary user accounts. This could lead to unauthorized user account deletions within the affected system.

The vulnerability allows authenticated users with teacher-level access or higher to delete arbitrary user accounts. This could disrupt user management and potentially impact the integrity of the system's user base. There is no indication of confidentiality or availability impact beyond the ability to delete users. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict teacher-level access to trusted users only and monitor user account deletions closely. Avoid granting unnecessary privileges to users who do not require them.