CVE-2022-1609: Weblizar School Management

Critical severity, CVSS 9.8. EPSS: 64.1% chance of exploitation in the next 30 days.

The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.

Affected products

• Weblizar School Management: before 9.9.7 (fixed in 9.9.7)

Published 2024-01-16. Last modified 2026-06-17.