The WPGYM – Wordpress Gym Management System is vulnerable to SQL Injection through several parameters in functions such as MJ_gmgt_delete_class_limit_for_member, MJ_gmgt_get_yearly_income_expense, MJ_gmgt_get_monthly_income_expense, MJ_gmgt_add_class_limit, MJ_gmgt_view_meeting_detail, and MJ_gmgt_create_meeting. The flaw results from insufficient escaping of user‑supplied data and lack of prepared statements, allowing unauthenticated attackers to append malicious SQL fragments to existing queries and extract sensitive database contents.

The vulnerability affects the dasinfomedia WPGYM – Wordpress Gym Management System plugin, specifically all releases up to and including version 67.8.0.

With a CVSS score of 7.5 the vulnerability poses a moderate to high severity risk. The EPSS score of <1% indicates a low but non‑zero likelihood of exploitation, and the flaw is not currently listed in the CISA KEV catalog. It is inferred that attackers can likely exploit the flaw remotely by sending crafted requests to the plugin’s exposed endpoints, even without authenticating to the WordPress installation.