CVE-2025-1668 identifies a missing authorization vulnerability (CWE-862) in the WPSchoolPress plugin for WordPress, a tool designed to manage school-related data and users. The vulnerability exists in the wpsp_DeleteUser() function, which lacks proper capability checks to verify whether the authenticated user has sufficient privileges to delete other user accounts. As a result, any authenticated user with teacher-level access or above can delete arbitrary user accounts, potentially disrupting user management and causing data integrity issues. This flaw affects all versions of the plugin up to and including 2.2.16. The vulnerability does not require user interaction beyond authentication and can be exploited remotely over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates that the attack is network-based, requires low attack complexity, privileges at the level of a teacher, no user interaction, unchanged scope, no confidentiality or availability impact, but a limited integrity impact. No patches or known exploits are currently available or reported. The vulnerability is significant in environments where multiple user roles exist and where teacher-level accounts are common, such as educational institutions using WordPress-based school management systems.

The primary impact of this vulnerability is on data integrity within affected organizations. Attackers with teacher-level access can delete arbitrary user accounts, which could disrupt school operations by removing students, staff, or administrative users. This could lead to denial of service for affected users, loss of important user data, and potential administrative overhead to restore accounts. Although confidentiality and availability are not directly impacted, the ability to manipulate user accounts undermines trust in the system and could be leveraged as part of a broader attack chain. Organizations relying on WPSchoolPress for managing school users face risks of internal misuse or exploitation by compromised teacher accounts. The impact is more pronounced in larger institutions with many users and complex role hierarchies, where unauthorized deletions could cause significant operational disruption.

To mitigate this vulnerability, organizations should immediately restrict teacher-level access to trusted personnel only and monitor user account deletions for suspicious activity. Applying updates or patches from the vendor once available is critical; if no patch exists, consider temporarily disabling the plugin or limiting its functionality. Implementing additional access control mechanisms at the WordPress level, such as role hardening or custom capability checks, can reduce risk. Regular backups of user data and user account configurations should be maintained to enable rapid recovery from unauthorized deletions. Employing security plugins that monitor and alert on privilege escalations or unusual user management activities can provide early warning. Additionally, organizations should conduct security audits of user roles and permissions within WordPress to ensure least privilege principles are enforced.