← CVE Intelligence

CVE-2022-1609

The School Management < 9.9.7 - Unauthenticated RCE via REST api PUBLISHED

Description (CNA)

The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.

Affected (CNA)

Vendor / productVersions
Unknown / school-management-proaffected 0 before 9.9.7

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.