Unauthenticated Remote Code Execution (RCE) via REST API discovered by Jetpack Scan Team and WordPress elevated support team in WordPress School Management Pro premium plugin (versions < 9.9.7).
Update the WordPress School Management Pro premium plugin to the latest available version (at least 9.9.7).