CVE-2025-1669 is an SQL Injection vulnerability in the WPSchoolPress WordPress plugin's 'addNotify' action. The issue arises from insufficient escaping and lack of prepared statements for user-supplied input, enabling authenticated users with teacher-level privileges or above to append malicious SQL queries. This can be leveraged to extract sensitive data from the backend database. The vulnerability affects all versions up to 2.2.17. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges at the level of a teacher, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an authenticated user with teacher-level access or higher to perform unauthorized SQL queries, potentially exposing sensitive information stored in the database. The vulnerability does not impact data integrity or availability but poses a confidentiality risk. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict teacher-level access to trusted users only and monitor for unusual database activity related to the 'addNotify' action. Avoid exposing the vulnerable plugin on publicly accessible sites if possible.