Local File Inclusion Vulnerability in WPGYM Plugin for WordPress

CVE-2025-3671

What is CVE-2025-3671?

The WPGYM plugin for WordPress is susceptible to a Local File Inclusion vulnerability through the 'page' parameter. This allows authenticated attackers with Subscriber-level access and higher to include arbitrary files from the server, potentially leading to code execution of malicious PHP scripts. The vulnerability can also facilitate privilege escalation, especially in Multisite environments, where attackers could change Super Administrator password settings. This highlights the importance of securing WordPress plugins and regularly updating them to mitigate risk.

References