Privilege Escalation Vulnerability in WPGYM Plugin for WordPress

CVE-2025-7049

What is CVE-2025-7049?

The WPGYM - WordPress Gym Management System plugin is susceptible to a privilege escalation vulnerability due to insufficient validation of a user-controlled key in the 'MJ_gmgt_gmgt_add_user' function. This flaw allows authenticated attackers with Subscriber-level access or higher to manipulate sensitive user data, including modifying email addresses, passwords, and other critical information of any user, even those with Administrator privileges. To safeguard your WordPress site, it's essential to update to the latest version of the plugin and implement appropriate security measures.

References