CVE-2022-1609: 
WordPress vulnerability analysis and mitigation

The School Management WordPress plugin before version 9.9.7 contained a critical security vulnerability (CVE-2022-1609) discovered in May 2022. The vulnerability involved an obfuscated backdoor injected into the plugin's license checking code that registers a REST API handler, allowing unauthenticated attackers to execute arbitrary PHP code on affected sites. The issue affected premium versions of the plugin from version 8.9 onwards, while the free version remained unaffected as it didn't include the licensing code (Hacker News).

The vulnerability was discovered on May 4, 2022, when researchers identified heavily obfuscated code within the license-checking functionality of the plugin. The security flaw received a CVSS score of 10.0 (Critical), representing the highest possible severity rating. The vulnerability allows for Remote Code Execution (RCE) through injection, classified under OWASP Top 10 category A1: Injection and CWE-94 (WPScan).

The vulnerability enables unauthenticated attackers to execute arbitrary PHP code on websites with the affected plugin installed, potentially granting them complete control over vulnerable websites. This poses a severe risk to affected educational institutions using the plugin for school operations management (Hacker News).

The vulnerability was patched in version 9.9.7 of the School Management Pro plugin. Users of affected versions are strongly recommended to update to this latest version to prevent potential exploitation. The vendor, Weblizar, has removed the backdoor code, though they stated they were unaware of when or how the code was introduced into their software (Hacker News).

The vulnerability was initially identified by the Jetpack Scan Team and WordPress elevated support team. The discovery raised significant concerns in the WordPress security community, particularly given that Weblizar, the plugin's developer, claims to have over 340,000 customers using their premium and free WordPress themes and plugins (Hacker News).