Read the docs
TI-2025-06782 Aliases CVE-2025-7442GHSA-3g9f-957v-6rr4

WPGYM - Wordpress Gym Management System < 67.8.0 - Unauthenticated SQL Injection

Priority LOW 39CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to SQL Injection via several parameters in the MJ_gmgt_delete_class_limit_for_member, MJ_gmgt_get_yearly_income_expense, MJ_gmgt_get_monthly_income_expense, MJ_gmgt_add_class_limit, MJ_gmgt_view_meeting_detail, and MJ_gmgt_create_meeting functions in all versions up to 67.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00373 31st percentileScored 2026-11-07
Fix Fixed WPGYM - Wordpress Gym Management System (dasinfomedia): 67.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dasinfomediaWPGYM - Wordpress Gym Management Systembefore 67.8.067.8.0Patch availableCNA
  • WPGYM - Wordpress Gym Management System Vendordasinfomedia Affected before 67.8.0 Fixed in 67.8.0 Patch available CNA

Remediation

  • Fix · CNA WPGYM - Wordpress Gym Management System (dasinfomedia) Fixed in 67.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-7442
  2. 2026-10-03 Alias added: GHSA-3g9f-957v-6rr4

References

Other 2

  • TI-2024-08961 School Management <= 91.5.0 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2024-09226 WPGYM <= 67.1.0 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2017-10876 WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter. CVSS 3.1HIGH 8.8
  • TI-2017-10875 Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter. CVSS 3.0HIGH 8.8
  • TI-2017-10874 Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter. CVSS 3.0HIGH 8.8
  • TI-2017-10873 Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter. CVSS 3.0HIGH 8.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences