CVE-2024-12332 – The WPSchoolPress WordPress plugin contains a S... (How to Fix)

Q: What is the severity of CVE-2024-12332?

CVE-2024-12332 has a CVSS score of 6.5 (MEDIUM). The WPSchoolPress WordPress plugin contains a SQL injection vulnerability in the 'cid' parameter that allows authenticated attackers with Student/Parent-level access or higher to execute arbitrary SQL queries. This can lead to unauthorized access to sensitive database information. All WordPress sites using WPSchoolPress versions up to 2.2.14 are affected.

📋 TL;DR

The WPSchoolPress WordPress plugin contains a SQL injection vulnerability in the 'cid' parameter that allows authenticated attackers with Student/Parent-level access or higher to execute arbitrary SQL queries. This can lead to unauthorized access to sensitive database information. All WordPress sites using WPSchoolPress versions up to 2.2.14 are affected.

💻 Affected Systems

Products:

WPSchoolPress WordPress Plugin

Versions: All versions up to and including 2.2.14

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with WPSchoolPress plugin enabled. Attackers need at least Student/Parent-level authenticated access.

📦 What is this software?

Wpschoolpress by Igexsolutions

View all CVEs affecting Wpschoolpress →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including extraction of sensitive user data, administrative credentials, and potential privilege escalation to full site control.

🟠

Likely Case

Unauthorized access to student records, grades, personal information, and other sensitive educational data stored in the database.

🟢

If Mitigated

Limited data exposure if proper input validation and parameterized queries are implemented, with minimal impact on system availability.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

SQL injection via 'cid' parameter requires authenticated access but exploitation is straightforward once credentials are obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.2.15 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3151238/wpschoolpress/trunk/pages/wpsp-teacher.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WPSchoolPress and click 'Update Now'. 4. Verify version is 2.2.15 or higher.

🔧 Temporary Workarounds

Temporary Plugin Deactivation

all

Disable the vulnerable plugin until patched version is available

wp plugin deactivate wpschoolpress

Web Application Firewall Rule

all

Block SQL injection patterns targeting the 'cid' parameter

Add WAF rule: Block requests containing SQL injection patterns in 'cid' parameter

🧯 If You Can't Patch

Restrict plugin access to trusted users only and implement strict access controls
Implement database monitoring and alerting for unusual SQL query patterns

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > WPSchoolPress version. If version is 2.2.14 or lower, system is vulnerable.

Check Version:

wp plugin get wpschoolpress --field=version

Verify Fix Applied:

Verify WPSchoolPress plugin version is 2.2.15 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL query patterns in database logs
Multiple failed login attempts followed by successful Student/Parent login
Unusual database queries from WordPress application user

Network Indicators:

HTTP POST requests to wpsp-teacher.php with SQL injection patterns in 'cid' parameter
Unusual database connection patterns from web server

SIEM Query:

source="web_logs" AND uri="*wpsp-teacher.php*" AND (param="*cid=*UNION*" OR param="*cid=*SELECT*" OR param="*cid=*INSERT*")

📊 Metadata

CVE ID: CVE-2024-12332

CVSS v3 Score: 6.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-89

EPSS Score: 0.25% exploit probability (48.3th percentile)

Published: January 7, 2025

Last Updated: July 14, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-12332, you might also want to check these: