PT-2025-33521 · WordPress · Wpgym - Wordpress Gym Management System

Thái An · Published 2025-08-16 · Updated 2025-08-21 · CVE-2025-3671

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WPGYM - Wordpress Gym Management System plugin versions prior to 67.7.1

Description: The WPGYM - Wordpress Gym Management System plugin for WordPress is susceptible to Local File Inclusion via the page parameter. This allows authenticated attackers with Subscriber-level access or higher to include and execute arbitrary files on the server, potentially enabling the execution of PHP code. This can be leveraged to bypass access controls, obtain sensitive data, or achieve code execution, particularly when combined with the ability to upload and include files. Exploitation can also lead to privilege escalation, such as updating the passwords of Super Administrator accounts in Multisite environments.

Recommendations: Update the WPGYM - Wordpress Gym Management System plugin to version 67.7.1 or later.

Fix

LPE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-3671

Affected Products

Wpgym - Wordpress Gym Management System

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-3671 · Security Note
• https://t.me/CVEtracker/30168 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6536d19f-a042-4404-b0c9-91aacd7768f7?source=cve · Note
• https://twitter.com/CVEnew/status/1956654790496412096 · Twitter Post
• https://twitter.com/CveFindCom/status/1956569357653352821 · Twitter Post
• https://t.me/cveNotify/132564 · Telegram Post
• https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964 · Note
• https://twitter.com/cracbot/status/1958484265705820165 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1956609455224684729 · Twitter Post