Privilege Escalation Vulnerability in WPGYM Plugin for WordPress

CVE-2025-7049

What is CVE-2025-7049?

The WPGYM - WordPress Gym Management System plugin is susceptible to a privilege escalation vulnerability due to insufficient validation of a user-controlled key in the 'MJ_gmgt_gmgt_add_user' function. This flaw allows authenticated attackers with Subscriber-level access or higher to manipulate sensitive user data, including modifying email addresses, passwords, and other critical information of any user, even those with Administrator privileges. To safeguard your WordPress site, it's essential to update to the latest version of the plugin and implement appropriate security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References