The WPGYM plugin is vulnerable to Local File Inclusion through the "page" parameter. An authenticated user with Subscriber-level access and above can include and execute arbitrary files on the server. Because the vulnerable files can be uploaded as seemingly safe types, an attacker can execute any PHP code. This ability can be used to bypass access controls, read sensitive data, or launch further attacks. In Multisite environments, the LFI can be chained to a dashboard view file that updates the password of Super Administrator accounts, providing a direct path to privilege escalation.

The issue affects installations of the WPGYM – Wordpress Gym Management System plugin up to and including version 67.7.0. Any WordPress site using the plugin, whether a single‑site or multisite network, is potentially impacted. The plugin is distributed by dasinfomedia under the WPGYM product name.

The CVSS score of 8.8 indicates high severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated with at least Subscriber privileges and must supply a crafted "page" parameter value. Once the inclusion succeeds, the attacker can execute arbitrary PHP, potentially compromising the host and escalating privileges by altering Super Admin passwords in Multisite sites.