CVE-2022-1609

CVE-2022-1609 describes a critical remote code execution vulnerability affecting the School Management WordPress plugin prior to version 9.9.7. This flaw stems from an obfuscated backdoor within the plugin's license checking code, which registers a REST API handler. The vulnerability carries a CVSS score of 9.8 (Critical), indicating it can be exploited remotely by an unauthenticated attacker with low complexity, leading to complete compromise of confidentiality, integrity, and availability. Its high EPSS and FAUCET Risk Score further emphasize the significant threat it poses. While not currently listed on the CISA KEV catalog, exploit intelligence shows available Nuclei templates for detection and exploitation. The vulnerability has garnered significant community discussion and media coverage, highlighting its awareness and potential for future exploitation.