MEDIUM

CVE-2025-15657

2026-06-17 CVSS v3.1

CVSS

5.3

Description

Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.

Summary dbcve.org

Unauthenticated IDOR vulnerability in School Management <= 93.1.0 allows unauthenticated attackers to directly reference object identifiers (e.g., database records, files) to access or modify sensitive data without proper authorization validation.

Mitigation

Implement proper object-level authorization checks on all sensitive endpoints and validate user permissions before allowing access to, or modification of, any object references.

Weakness (CWE)

CWE-639 Authorization Bypass (IDOR)

EPSS Score

0.22%

Probability of exploitation in next 30 days

12.9th percentile

References

https://patchstack.com/database/wordpress/plugin/school-management/vulnerability/wordpress-school-management-plugin-plugin-93-1-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE