{"id":59603,"date":"2025-07-24T05:57:19","date_gmt":"2025-07-24T05:57:19","guid":{"rendered":""},"modified":"2025-08-08T17:09:06","modified_gmt":"2025-08-08T23:09:06","slug":"cve-2025-3740-critical-local-file-inclusion-vulnerability-in-school-management-system-for-wordpress-plugin","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-3740-critical-local-file-inclusion-vulnerability-in-school-management-system-for-wordpress-plugin\/","title":{"rendered":"CVE-2025-3740: Critical Local File Inclusion Vulnerability in School Management System for WordPress Plugin<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-3740 vulnerability refers to a Local File Inclusion (LFI) flaw found in the School Management System for WordPress plugin. This vulnerability, which affects all versions up to and including 93.1.0, could potentially allow an authenticated attacker to execute arbitrary PHP code files on a server. This flaw is particularly concerning as it can be used to bypass access controls, gain sensitive data, or achieve code execution<\/a> in cases where images and other \u201csafe\u201d file types can be uploaded and included. As a result, systems that use this WordPress plugin<\/a> are at risk for data leakage or potential system compromise.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-3740
\nSeverity: Critical (CVSS: 8.8)
\nAttack Vector: Local
\nPrivileges Required: Subscriber-level access
\nUser Interaction: Required
\nImpact: System compromise and potential<\/a> data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

School Management System<\/a> for WordPress | Up to and including 93.1.0<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of a Local File Inclusion vulnerability<\/a> in the ‘page’ parameter of the School Management System for WordPress plugin. An attacker with Subscriber-level access or above can include and execute arbitrary files<\/a> on the server. This allows the execution of any PHP code in those files<\/a>, which can be used to bypass access controls or obtain sensitive data. In cases where images and other supposedly “safe” file types can be uploaded<\/a> and included, this exploit can also achieve code execution. This vulnerability can further be chained with other exploits to include various dashboard view files<\/a> in the plugin, potentially leading to privilege escalation.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how the exploit might be triggered. This is a representation of a malicious HTTP request<\/a> that an attacker could send.<\/p>\n

POST \/wp-admin\/admin-ajax.php?action=sms_manage_page HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{ \"page\": \"\/path\/to\/malicious\/file.php\" }<\/code><\/pre>\n
In the above example, the attacker is attempting to include a malicious PHP file<\/a> located at “\/path\/to\/malicious\/file.php. If successful, this would allow the attacker to execute arbitrary PHP code<\/a> on the server.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The CVE-2025-3740 vulnerability refers to a Local File Inclusion (LFI) flaw found in the School Management System for WordPress plugin. This vulnerability, which affects all versions up to and including 93.1.0, could potentially allow an authenticated attacker to execute arbitrary PHP code files on a server. This flaw is particularly concerning as it can […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[76],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-59603","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-privilege-escalation"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t