CVE-2026-39631

MediumCVSS 4.9

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The WPSchoolPress plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 2.2.35.

Risk Assessment

An attacker can gain unauthorized access to school functions, potentially leading to modification of student data or settings.

Recommendation

Immediately update the WPSchoolPress plugin to the latest available version.

Original NVD description (English source)

Missing Authorization vulnerability in Ronik@UnlimitedWP WPSchoolPress wpschoolpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through <= 2.2.35.