Access violation vulnerability in School Management System – WPSchoolPress 2.2.10

The WPSchoolPress plugin for WordPress, which helps manage schools, has a security issue that allows attackers to gain higher-level access to user accounts. This is because the plugin does not properly check a user’s identity before allowing changes to their email address. As a result, attackers with teacher-level access or higher can change any user’s email, including administrators, and use that to reset their password and take over their account.