9.8
Critical
CVE-2022-1609 The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking…
Description
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| school-management-pro 9.9 | earliest → < 9.9.7 | 9.9.7 |