title: The School Management < 9.9.7 - Unauthenticated RCE via REST api
description: The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
vendor: Unknown
product: school-management-pro
versions:
status: affected, versionType: semver, version: 0, lessThan: 9.9.7
defaultStatus: unaffected
}