A flaw in the WordPress Gym Management plugin (WPGYM) allows the inclusion of arbitrary local files because the program does not properly validate the filename used in its include/require statements. This can enable an attacker to read sensitive files from the server or, in some configurations, execute PHP code from locally stored files. The weakness is categorized as a file inclusion vulnerability (CWE-98).

The vulnerability affects the WPGYM plugin developed by mojoomla, specifically all releases from the earliest available version up through 65.0. If a site is running any of these versions, the plugin is susceptible.

The CVSS score of 7.5 indicates a moderate to high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The issue is not listed in the CISA KEV catalog, meaning there are no confirmed large‑scale attacks yet. Attackers would typically target the web application to trigger the local file inclusion through crafted requests or interface input, potentially leading to information disclosure or code execution if the attacker can place a malicious file on the server.