The vulnerability in the WPGYM plugin allows an authenticated user with Subscriber-level access to create new WordPress users, including administrators, because the plugin does not enforce proper capability checks before adding users. This oversight is a classic privilege escalation flaw (CWE-269) that can give an attacker full control over the site, enabling data exfiltration, site defacement, or further attacks. The impact is a compromise of confidentiality, integrity, and availability for the entire WordPress installation.

The flaw exists in the WPGYM – Wordpress Gym Management System plugin for WordPress versions up to and including 67.7.0. Users operating these versions should consider themselves at risk until they are upgraded.

The vulnerability scores 8.8 on the CVSS scale, indicating a high severity. The EPSS score is below 1%, suggesting that exploitation is currently unlikely but still possible. The attacker must be authenticated and have at least Subscriber permissions, then can exploit the plugin’s user-creation functionality to inject admin accounts. The vulnerability is not listed in the CISA KEV catalog, but given its high impact, it warrants immediate attention.