WPGYM - Wordpress Gym Management System
WPGYM - Wordpress Gym Management System has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2025; 4 are fixed and 6 remain unpatched as of September 2026. Their average CVSS score is 8.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 8 high. 2025 was the busiest year with 7 disclosures.
The most common weakness is SQL Injection, behind 4 of the records (40%). Other recurring categories include Improper Privilege Management, Authorization Bypass Through User-Controlled Key.
4 of the records (40%) have a vendor fix, while 6 remain unpatched. The oldest unresolved one dates back to 2017.
8 independent researchers contributed these findings, most of them (2) reported by Tonn.
CVE-2025-7049WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Read the full analysisVulnerability Records
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C