CVE-2025-1668
📋 TL;DR
The WPSchoolPress WordPress plugin has a missing capability check that allows authenticated users with teacher-level access or higher to delete any user account. This vulnerability affects all WordPress sites using WPSchoolPress versions up to 2.2.16.
💻 Affected Systems
- WPSchoolPress WordPress Plugin
📦 What is this software?
Wpschoolpress by Igexsolutions
⚠️ Risk & Real-World Impact
Worst Case
Malicious teacher or administrator deletes all user accounts including administrators, causing complete system disruption and potential data loss.
Likely Case
Disgruntled teacher deletes other teacher or administrator accounts, disrupting school operations and requiring account restoration.
If Mitigated
Limited to authorized users only, with proper monitoring detecting unusual deletion patterns.
🎯 Exploit Status
Exploitation requires authenticated access with teacher-level permissions or higher. The vulnerability is simple to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.17 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.17/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins > Installed Plugins
3. Find WPSchoolPress and click 'Update Now'
4. If update not available, download version 2.2.17+ from WordPress repository
5. Deactivate old version, upload new version, activate
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable WPSchoolPress plugin until patched
wp plugin deactivate wpschoolpress
Restrict Teacher Access
allTemporarily downgrade teacher accounts to lower privilege levels
UPDATE wp_users SET user_level = 1 WHERE user_level >= 5
🧯 If You Can't Patch
- Implement strict user role monitoring and alert on unusual deletion patterns
- Enable comprehensive logging of all user deletion events and review daily
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > WPSchoolPress version. If version is 2.2.16 or lower, system is vulnerable.Check Version:
wp plugin get wpschoolpress --field=versionVerify Fix Applied:
Verify WPSchoolPress version is 2.2.17 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple user deletion events from teacher accounts
- Unusual pattern of user deletions outside normal hours
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=wpsp_DeleteUser
SIEM Query:
source="wordpress.log" action="user_deleted" user_role="teacher" | stats count by src_user