CVE-2026-9767 describes an SQL Injection vulnerability in the The School Management – Education & Learning ERP WordPress plugin (up to version 5.4). The flaw arises from insufficient escaping and lack of proper preparation of the 'order[0][dir]' parameter in several AJAX handlers such as wlsm-fetch-staff-classes, wlsm-fetch-notices, and others. Authenticated attackers with custom-level or higher privileges can inject additional SQL commands, potentially extracting sensitive data. The absence of nonce verification on several handlers also allows cross-site request forgery (CSRF) to chain with the SQL Injection, increasing exploitation risk. No official patch or remediation level is currently indicated.

Successful exploitation allows an authenticated user with custom-level access or above to perform SQL Injection attacks, leading to unauthorized disclosure of sensitive information from the database. The lack of nonce verification on some AJAX handlers further enables CSRF attacks that can facilitate exploitation without direct user interaction. There is no indication of impact on data integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to authenticated users with custom-level privileges or higher and monitor for suspicious activity. Consider disabling or restricting the affected AJAX handlers if feasible. Implement nonce verification on AJAX requests to prevent CSRF-chained exploitation.