The WPGYM plugin for WordPress contains a flaw in the MJ_gmgt_gmgt_add_user function, where a user‐controlled key is not validated. As a result, any authenticated user with Subscriber role or higher can alter the email, password, and other sensitive details of any account, including administrators. This constitutes a privilege escalation that allows an attacker to take over another user’s account, compromising confidentiality and integrity of the system.

The vulnerability affects dasinfomedia’s WPGYM – Wordpress Gym Management System plugin. All releases up to and including version 67.7.0 are impacted.

The CVSS rating of 8.8 reflects a high severity. EPSS indicates a very low probability of exploitation, likely because the attacker must first authenticate as a Subscriber or higher. The flaw is not listed in CISA’s KEV catalog. If an attacker gains a legitimate subscriber account, the lack of validation enables immediate account takeover of higher‑privilege users such as administrators. The attack vector is therefore local to the WordPress site and requires authentication, but once achieved, it provides full control over target accounts.