PT-2025-21695 · Wpgym · Wpgym

Bonds · Published 2025-05-16 · Updated 2025-05-16 · CVE-2025-32643

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions: WPGYM versions prior to 65.0

Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection, which allows Blind SQL Injection. This is due to the improper handling of special elements in SQL commands.

Recommendations: For versions prior to 65.0, update to version 65.0 to resolve the issue. As a temporary workaround, consider restricting access to sensitive database queries to minimize the risk of exploitation. Avoid using user-supplied input in SQL commands until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-32643

Affected Products

Wpgym

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-32643 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/gym-management/vulnerability/wordpress-wpgym-plugin-65-0-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1923408946313736474 · Twitter Post
• https://twitter.com/CVEnew/status/1923434412563366070 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/gym-management/vulnerability/wordpress-wpgym-plugin-65-0-sql-injection-vulnerability?_s_id=cve · Note