The WPGYM – WordPress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67.7.0. This vulnerability arises from the plugin’s failure to properly validate a user’s capabilities before adding users. As a result, authenticated attackers with Subscriber-level access and above can create new users, including admins.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-6080 |
Exploitation
To exploit this vulnerability, an attacker with Subscriber-level access can leverage the lack of proper validation in the plugin to create new user accounts, including those with administrative privileges. This can lead to unauthorized access and control over the WordPress site.
Affected Products
- WPGYM Plugin: All versions up to and including 67.7.0 are affected, allowing unauthorized user creation.
Mitigation
To mitigate this vulnerability, it is recommended to update the WPGYM plugin to the latest version where this issue has been addressed. Additionally, implementing strict user role management and monitoring user activities can help prevent unauthorized access.