J4Ck13Ch4N

**Name of the Vulnerable Software and Affected Versions** The School Management – Education & Learning ERP plugin for WordPress versions prior to 5.5 **Description** Authenticated attackers with custom-level access and above can perform SQL Injection by appending additional queries to existing ones to extract sensitive database information. This occurs due to insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries. The issue affects the `order[0][dir]` parameter across seven or more AJAX handlers, including `wlsm-fetch-staff-classes`, `wlsm-fetch-notices`, `wlsm-fetch-subjects`, `wlsm-fetch-inquiries`, `wlsm-fetch-staff-employee`, and `wlsm-fetch-payments`. Additionally, the absence of nonce verification—a security token used to prevent Cross-Site Request Forgery (CSRF)—on several of these handlers allows for CSRF-chained exploitation. **Recommendations** Update the School Management – Education & Learning ERP plugin for WordPress to a version newer than 5.4.

**Name of the Vulnerable Software and Affected Versions** SEO Redirection Plugin versions prior to 9.19 **Description** The plugin fails to perform a capability check in an authenticated AJAX action. This allows any logged-in user, including those with subscriber-level privileges, to access and read the configured 301 redirect rules, which include the source and destination URLs. **Recommendations** Update the plugin to version 9.19 or later.

**Name of the Vulnerable Software and Affected Versions** PayU CommercePro Plugin WordPress plugin versions prior to 3.9.0 **Description** The plugin fails to verify the payment-gateway signature before applying order modifications. This allows unauthenticated attackers to tamper with the totals, shipping, and metadata of arbitrary WooCommerce orders. **Recommendations** Update the plugin to version 3.9.0 or later.