PT-2025-29217 · WordPress · Wpgym - Wordpress Gym Management System

Trương Hữu Phúc + 1 · Published 2025-07-11 · Updated 2025-07-11 · CVE-2025-7442

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: WPGYM - Wordpress Gym Management System plugin versions prior to 67.8.0

Description: The WPGYM - Wordpress Gym Management System plugin for WordPress is susceptible to SQL Injection due to insufficient input validation and query preparation. This allows unauthenticated attackers to inject malicious SQL queries into existing database queries, potentially leading to the extraction of sensitive information. The vulnerability exists in the MJ gmgt delete class limit for member, MJ gmgt get yearly income expense, MJ gmgt get monthly income expense, MJ gmgt add class limit, MJ gmgt view meeting detail, and MJ gmgt create meeting functions.

Recommendations: Update the WPGYM - Wordpress Gym Management System plugin to version 67.8.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-7442

Affected Products

Wpgym - Wordpress Gym Management System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-7442 · Security Note
• https://t.me/cvenotify/128506 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1943602253115330827 · Twitter Post
• https://t.me/cvetracker/27545 · Telegram Post
• https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964?s_rank=2 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e52289fe-9a38-4ebf-b24a-034768fa56b7?source=cve · Note
• https://twitter.com/CVEnew/status/1943668128631992563 · Twitter Post