SQL Injection Vulnerability in WPGYM WordPress Gym Management System
CVE-2025-7442

7.5HIGH

Key Information:

Vendor

WordPress
Status
WPgym - WordPress Gym Management System
Vendor
CVE Published:
11 July 2025

What is CVE-2025-7442?

The WPGYM plugin for WordPress is susceptible to SQL Injection through multiple parameters in functions such as MJ_gmgt_delete_class_limit_for_member and MJ_gmgt_get_monthly_income_expense. Due to inadequate escaping of user-supplied input, attackers can manipulate existing SQL queries, allowing them to extract sensitive information stored within the database. This vulnerability affects all versions of the plugin up to 67.8.0, posing a significant risk for users leveraging this tool for gym management.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

WPGYM - Wordpress Gym Management System * < 67.8.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://codecanyon.net/item/-wpgym-wordpress-gym-manageme...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trương Hữu Phúc (truonghuuphuc)
JSON
.