CVE-2022-1609: School Management WordPress plugin backdoor enables unauthenticated PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution via a deliberate backdoor with a 9.8 CVSS score and high EPSS probability makes this an urgent patch-or-remove case.

What it is

The School Management WordPress plugin before 9.9.7 shipped with an obfuscated backdoor hidden in its license checking code. That backdoor registers a REST API handler, letting an unauthenticated attacker run arbitrary PHP code on the site. Because it is a deliberate backdoor rather than an accidental bug, any site running an affected version is exposed until the plugin is updated or removed.

Impact

An attacker gains remote code execution on the WordPress host, which typically means full control of the site and its data, and potentially the underlying server depending on configuration.

Attack surface

Reachable over the network through the plugin's registered REST API handler; the CVSS vector shows no privileges or user interaction required. No authentication is needed to hit the endpoint.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.64075, 99.188th percentile) and both references are tagged Exploit, indicating public exploit information exists. No ransomware group usage is documented in the record.

What to do

• Update the School Management plugin to 9.9.7 or later immediately; if no update is available, deactivate and remove the plugin.
• Treat any site that ran an affected version as compromised: rotate WordPress admin, database and hosting credentials and any secrets stored on the host.
• Audit the site for unexpected REST API routes, modified plugin files and injected PHP, and restore from a known-good backup if tampering is found.
• Restrict or monitor access to the WordPress REST API at the WAF or reverse proxy where operationally feasible.
• Review other plugins from the same vendor for similar license-check backdoors before reinstalling.

Detection

• Search web and access logs for requests to unusual or unexpected REST API routes under /wp-json/ that return 200 and originate from unfamiliar IPs.
• Compare installed plugin files against the official 9.9.7 release and hash-check for obfuscated or base64-encoded PHP in the license checking code.
• Monitor for unexpected outbound connections and new files or processes on the WordPress host that do not match normal site behavior.
• Enable WordPress file integrity monitoring and alert on changes to plugin directories outside of scheduled updates.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.