title: WPSchoolPress < 2.2.5 - Teacher+ SQLi
description: The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
problem types: CWE-89 SQL Injection
affected:
{
vendor: Unknown
product: School Management System
versions:
status: affected, versionType: custom, version: 0, lessThan: 2.2.5
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}