Input validation vulnerability in School Management System for WordPress 92.0.0

The WordPress plugin called School Management System is at risk of being hacked through a process called SQL Injection. This happens when the ‘id’ parameter is used in the ‘mj_smgt_show_event_task’ action through AJAX. The vulnerability exists in all versions up to 92.0.0. This is due to not enough protection on the user-provided parameter and not enough careful handling of the existing SQL query. This allows attackers who are logged in and have Custom-level access or higher to add their own SQL queries into the ones that already exist. This can lead to the extraction of important and private information from the database.