Unauthorized Admin Account Creation Vulnerability in WPGYM for WordPress

CVE-2025-6080

What is CVE-2025-6080?

The WPGYM - WordPress Gym Management System plugin is affected by a significant security flaw where improper user capability validation allows an authenticated attacker with Subscriber-level access or higher to create new users, including those with admin privileges. This vulnerability impacts all versions up to and including 67.7.0, raising serious concerns about unauthorized access to sensitive areas of the application. It is crucial for users to update to the latest version to mitigate these risks and secure their systems.

References