SQL Injection Vulnerability in WPGYM WordPress Gym Management System
CVE-2025-7442
7.5HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 July 2025
What is CVE-2025-7442?
The WPGYM plugin for WordPress is susceptible to SQL Injection through multiple parameters in functions such as MJ_gmgt_delete_class_limit_for_member and MJ_gmgt_get_monthly_income_expense. Due to inadequate escaping of user-supplied input, attackers can manipulate existing SQL queries, allowing them to extract sensitive information stored within the database. This vulnerability affects all versions of the plugin up to 67.8.0, posing a significant risk for users leveraging this tool for gym management.
Affected Version(s)
WPGYM - Wordpress Gym Management System * < 67.8.0