PT-2025-37016 · WordPress · Wpgym+1

Michelle Porter · Published 2025-09-10 · Updated 2025-09-15 · CVE-2025-7049

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WPGYM - Wordpress Gym Management System plugin for WordPress versions prior to 67.7.1

Description: The plugin is susceptible to privilege escalation due to missing validation on a user-controlled key within the MJ gmgt gmgt add user function. Authenticated attackers with Subscriber-level access or higher can modify the email, password, and other details of any user, including administrators.

Recommendations: Update to version 67.7.1 or later. As a temporary workaround, restrict access to the MJ gmgt gmgt add user function until a patch is available.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-7049

Affected Products

Wpgym

Wpgym - Wordpress Gym Management System

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-7049 · Security Note
• https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964 · Note
• https://twitter.com/VulmonFeeds/status/1965714890082881764 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/17951f68-8481-477b-a940-cce637f6ec54?source=cve · Note
• https://twitter.com/cracbot/status/1967543964975894749 · Twitter Post
• https://twitter.com/CVEnew/status/1965691862330867914 · Twitter Post