CVE-2025-1667

CVE-2025-1667 describes a privilege escalation vulnerability in the WPSchoolPress plugin for WordPress, affecting all versions up to and including 2.2.16. This flaw allows authenticated attackers with teacher-level access to modify arbitrary user details, including email addresses, which can then be leveraged to reset passwords and gain control of other user accounts, including administrators. Rated as Medium severity (CVSS 4.3), the vulnerability is easily exploitable over the network with low attack complexity, though it currently lacks public exploit code, Metasploit modules, or significant community discussion. There is no evidence of active exploitation, nor is it listed in CISA's KEV catalog.