Researchers Find Backdoor in School Management Plugin for WordPress


Multiple versions of a WordPress plugin by the name of “School Management Pro” harbored a backdoor that could grant an adversary complete control over vulnerable websites.

The issue, spotted in premium versions before 9.9.7, has been assigned the CVE identifier CVE-2022-1609 and is rated 10 out of 10 for severity.

The backdoor, which is believed to have existed since version 8.9, enables “an unauthenticated attacker to execute arbitrary PHP code on sites with the plugin installed,” Jetpack’s Harald Eilertsen said in a Friday write-up.

School Management, developed by an India-based company called Weblizar, is billed as a WordPress add-on to “manage complete school operation.” It also claims more than 340,000 customers of its premium and free WordPress themes and plugins.

The WordPress security company noted that it uncovered the implant on May 4 after it was alerted to the presence of heavily obfuscated code in the license-checking code of the plugin. The free version of School Management, which doesn’t pack the licensing code, is not impacted.


While the backdoor has since been removed, the exact origins of the compromise remains unclear, with the vendor stating that “they do not know when or how the code came into their software.”

Customers of the plugin are recommended to update to the latest version (9.9.7) to prevent active exploitation attempts.

Products You May Like

Articles You May Like

Know your payment options: How to shop and pay safely this holiday season
Panaseer Launches Guidance on Security Controls Ahead of EU’s New Legislation
Google Releases Chrome Patch to Fix New Zero-Day Vulnerability
Researchers Detail AppSync Cross-Tenant Vulnerability in Amazon Web Services
RansomBoggs: New ransomware targeting Ukraine

Leave a Reply

Your email address will not be published. Required fields are marked *