The WPGYM – WordPress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the ‘page’ parameter. Authenticated attackers with Subscriber-level access and above can include and execute arbitrary files on the server, allowing for the execution of any PHP code. This vulnerability can be exploited to bypass access controls, obtain sensitive data, or achieve code execution, particularly in Multisite environments where privilege escalation is possible.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-3671 |
Exploitation
To exploit this vulnerability, an authenticated attacker can manipulate the ‘page’ parameter in requests to include arbitrary files on the server. This can lead to the execution of PHP code, allowing the attacker to bypass access controls and potentially escalate privileges within the WordPress environment.
Affected Products
- WPGYM – WordPress Gym Management System: A plugin for managing gym memberships and schedules, vulnerable to Local File Inclusion.
Mitigation
To mitigate this vulnerability, it is recommended to update the WPGYM plugin to the latest version. Additionally, restricting access to the plugin’s functionalities and implementing proper file validation can help prevent exploitation.