PT-2025-33523 · WordPress · Wpgym - Wordpress Gym Management System

Friderika Baranyai · Published 2025-08-16 · Updated 2025-08-21 · CVE-2025-6080

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WPGYM - Wordpress Gym Management System plugin versions prior to 67.7.1

Description: The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation. This is due to the plugin not properly validating a user's capabilities prior to adding users, allowing authenticated attackers with Subscriber-level access and above to create new users, including administrators.

Recommendations: Update the WPGYM - Wordpress Gym Management System plugin to version 67.7.1 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-6080

Affected Products

Wpgym - Wordpress Gym Management System

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-6080 · Security Note
• https://t.me/cveNotify/132566 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1956604335380468084 · Twitter Post
• https://twitter.com/cracbot/status/1958484269296128338 · Twitter Post
• https://t.me/CVEtracker/30170 · Telegram Post
• https://twitter.com/CVEnew/status/1956654788608991327 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6f853657-1801-4d63-89b8-b2132212a205?source=cve · Note
• https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964 · Note
• https://twitter.com/CveFindCom/status/1956569252133032018 · Twitter Post