What the vulnerability does
01Description
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The Local File Inclusion exploit can be chained to include various dashboard view files in the plugin. One in particular reported by the researcher can be leveraged to update the password of Super Administrator accounts in Multisite environments making privilege escalation possible.
Explanation of Vulnerability in Simple Terms
02Summary
WPGYM contains a path traversal vulnerability that allows authenticated users with low privileges to read, modify, or delete arbitrary files on the server. An attacker can bypass directory restrictions and access sensitive files outside the intended application folder. This affects all versions up to 67.7.0. Update immediately to a version newer than 67.7.0.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete any file on the server that the web server process can access.
Potential impact on your site
04Site Impact
Attackers with basic site access can steal database credentials, configuration files, or other users' data, or corrupt site files.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
August 16, 2025
CVE published
April 8, 2026
Record updated
