CVE-2026-9767 describes an SQL Injection vulnerability in the The School Management – Education & Learning ERP WordPress plugin (up to and including version 5.4). The flaw arises from insufficient escaping of the 'order[0][dir]' parameter and lack of proper SQL query preparation, allowing authenticated attackers with custom-level access or above to inject additional SQL commands. This vulnerability affects at least seven AJAX handlers, including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments. Additionally, missing nonce verification on several handlers facilitates CSRF-chained exploitation. No official patch or remediation level has been published yet.

An attacker with authenticated access at custom-level or higher can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands. The lack of nonce verification on some AJAX handlers also allows cross-site request forgery (CSRF) chained attacks, potentially increasing the attack surface. There is no indication of impact on data integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for suspicious activity related to the affected AJAX handlers. Implement manual input validation and nonce verification where possible to reduce risk.