CVE-2025-32643CWE-89

WordPress WPGYM Plugin <= 65.0 - SQL Injection vulnerability

Critical · published May 16, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

🚨 A tiny oversight has created a massive vulnerability! An SQL injection flaw in mojoomla WPGYM allows attackers to exploit data invisibly—it's like a magician making your information disappear! 🔥 Think of this vulnerability as a sneaky double agent at a high-security facility. While everyone else is busy watching the door, this agent slips in through the cracks, gathering sensitive information without anyone being the wiser! This Blind SQL Injection vulnerability means that an attacker can extract data from your database without any visible traces. Imagine them rifling through confidential records, swiping user details or financial info without setting off alarms—completely devastating!

Put simply

Think of this vulnerability as a sneaky double agent at a high-security facility. While everyone else is busy watching the door, this agent slips in through the cracks, gathering sensitive information without anyone being the wiser! In mojoomla WPGYM versions up to 65.0, improper neutralization of special elements allows SQL commands to be injected, leading to unauthorized data access. This flaw poses a serious risk for any application that relies on this vulnerable software.

What to do

This Blind SQL Injection vulnerability means that an attacker can extract data from your database without any visible traces. Imagine them rifling through confidential records, swiping user details or financial info without setting off alarms—completely devastating! Immediately patch to the latest version of WPGYM to close this SQL injection gap. Additionally, conduct a security audit of your database queries to ensure they're safeguarded against similar attacks in the future! You've got this! Following these steps, you'll enhance your security and protect your data like a true hero! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-05-16T15:45Z
EPSS history
Timeline
  • 16 MAY 15:45Z
    WordPress WPGYM Plugin <= 65.0 - SQL Injection vulnerability
    cvelistv5