Unauthorized Admin Account Creation Vulnerability in WPGYM for WordPress

CVE-2025-6080

What is CVE-2025-6080?

The WPGYM - WordPress Gym Management System plugin is affected by a significant security flaw where improper user capability validation allows an authenticated attacker with Subscriber-level access or higher to create new users, including those with admin privileges. This vulnerability impacts all versions up to and including 67.7.0, raising serious concerns about unauthorized access to sensitive areas of the application. It is crucial for users to update to the latest version to mitigate these risks and secure their systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References