CVE-2025-6079 is an unrestricted file upload vulnerability in the dasinfomedia School Management System for WordPress plugin. The issue arises from the lack of proper file type validation in the homework.php file, allowing authenticated users with at least Student-level privileges to upload arbitrary files. This flaw can potentially enable remote code execution on the server hosting the plugin. The vulnerability affects all versions up to 93.2.0. There is no vendor-provided patch or official remediation information available at this time. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and privileges required.

An attacker with authenticated access at the Student level or higher can upload arbitrary files to the server, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability allows an attacker to execute malicious code remotely, which can lead to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Student-level user permissions where possible and monitor for suspicious file uploads. Avoid granting unnecessary privileges to users and consider disabling or removing the vulnerable plugin if feasible.