School Management System for WordPress Missing Authorization Vulnerability Allowing Unauthenticated Post Deletion
Vulnerability
A vulnerability exists in the School Management System for WordPress plugin, affecting all versions through 93.0.0. The issue arises from a lack of proper capability checks on the 'mj_smgt_remove_feetype' and 'mj_smgt_remove_category_new' AJAX actions. This flaw enables unauthenticated attackers to delete arbitrary posts, leading to unauthorized data loss.
Impact
Exploitation of this vulnerability allows for unauthorized deletion of posts, potentially leading to loss of important data or disruption of site content.
Remediation
No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.