SQL Injection Risk in MojoJoomla WPGYM by MojoJoomla
CVE-2025-32574

8.5HIGH

Key Information:

Vendor

WordPress
Status
WPgym
Vendor
CVE Published:
16 July 2025

What is CVE-2025-32574?

A security vulnerability in the MojoJoomla WPGYM plugin allows malicious actors to perform SQL injection attacks. This vulnerability arises from improper neutralization of special elements in SQL commands, enabling attackers to manipulate queries executed by the backend database. It primarily affects WPGYM from versions prior to 65.0, posing serious risks to data integrity and application security.

Affected Version(s)

WPGYM <= 65.0

References

https://patchstack.com/database/wordpress/plugin/gym-mana...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thái An (Patchstack Alliance)
.
CVE-2025-32574 : SQL Injection Risk in MojoJoomla WPGYM by MojoJoomla