CVE-2025-7049: fallo de gravedad alta en dasinfomedia WPGYM - Wordpress Gym Management…
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.3%
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 67.7.0 via the 'MJ_gmgt_gmgt_add_user' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the email, password, and other details of any user, including Administrator users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
dasinfomedia · WPGYM - Wordpress Gym Management SystemCVEs relacionadas — dasinfomedia WPGYM - Wordpress Gym Management…
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-9942CRITICALWPGYM <= 67.1.0 - Unauthenticated Arbitrary File UploadEPSS 1.2%CVE-2025-3671HIGHWPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password UpdateEPSS 0.8%CVE-2024-9941HIGHWPGYM <= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationEPSS 0.6%CVE-2025-7442HIGHWPGYM - Wordpress Gym Management System < 67.8.0 - Unauthenticated SQL InjectionEPSS 0.4%CVE-2025-6080HIGHWPGYM <= 67.7.0 - Missing Authorization to Admin Account CreationEPSS 0.3%