CVE-2025-3671

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3671", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-15T22:04:45.953Z", "datePublished": "2025-08-16T03:38:49.460Z", "dateUpdated": "2026-04-08T16:57:44.648Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:44.648Z"}, "affected": [{"vendor": "dasinfomedia", "product": "WPGYM - Wordpress Gym Management System", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "67.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included. The Local File Inclusion exploit can be chained to include various dashboard view files in the plugin. One in particular reported by the researcher can be leveraged to update the password of Super Administrator accounts in Multisite environments making privilege escalation possible."}], "title": "WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6536d19f-a042-4404-b0c9-91aacd7768f7?source=cve"}, {"url": "https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc)"}, {"lang": "en", "type": "finder", "value": "Th\u00e1i An"}], "timeline": [{"time": "2025-08-15T14:56:02.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-18T13:37:00.643778Z", "id": "CVE-2025-3671", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-18T19:00:23.122Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3671", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-18T13:37:00.643778Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-18T13:37:04.255Z"}}], "cna": {"title": "WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update", "credits": [{"lang": "en", "type": "finder", "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc)"}, {"lang": "en", "type": "finder", "value": "Th\u00e1i An"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "dasinfomedia", "product": "WPGYM - Wordpress Gym Management System", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "67.7.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-15T14:56:02.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6536d19f-a042-4404-b0c9-91aacd7768f7?source=cve"}, {"url": "https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964"}], "descriptions": [{"lang": "en", "value": "The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included. The Local File Inclusion exploit can be chained to include various dashboard view files in the plugin. One in particular reported by the researcher can be leveraged to update the password of Super Administrator accounts in Multisite environments making privilege escalation possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:44.648Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3671", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:57:44.648Z", "dateReserved": "2025-04-15T22:04:45.953Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-16T03:38:49.460Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPGYM - Wordpress Gym Management System", "vendor": "dasinfomedia", "versions": [{"lessThanOrEqual": "67.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included. The Local File Inclusion exploit can be chained to include various dashboard view files in the plugin. One in particular reported by the researcher can be leveraged to update the password of Super Administrator accounts in Multisite environments making privilege escalation possible."}, {"lang": "es", "value": "El complemento WPGYM - Wordpress Gym Management System para WordPress es vulnerable a la Inclusi\u00f3n Local de Archivos en todas las versiones hasta la 67.7.0 incluida, a trav\u00e9s del par\u00e1metro 'page'. Esto permite a atacantes autenticados, con acceso de suscriptor o superior, incluir y ejecutar archivos arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en dichos archivos. Esto puede utilizarse para eludir los controles de acceso, obtener datos confidenciales o ejecutar c\u00f3digo cuando se pueden subir e incluir im\u00e1genes y otros tipos de archivos \"seguros\". El exploit de Inclusi\u00f3n Local de Archivos puede encadenarse para incluir varios archivos de vista del panel de control en el plugin. Uno en particular, reportado por el investigador, puede aprovecharse para actualizar la contrase\u00f1a de las cuentas de superadministrador en entornos multisitio, lo que permite la escalada de privilegios."}], "id": "CVE-2025-3671", "lastModified": "2026-06-17T09:20:27.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3671", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-18T13:37:00.643778Z", "version": "2.0.3"}}]}, "published": "2025-08-16T04:15:57.460", "references": [{"source": "security@wordfence.com", "url": "https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6536d19f-a042-4404-b0c9-91aacd7768f7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:55:35.248608+00:00", "value": {"mitigation_remediation": ["Update the WPGYM plugin to a version newer than 67.7.0 or apply the vendor\u2019s official fix", "If an update is not immediately available, deactivate or uninstall the plugin to prevent the LFI path", "Restrict the \"page\" request parameter and uploaded file types via WordPress or server configuration to block inclusion of arbitrary files"], "summary": {"action": "Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The issue affects installations of the WPGYM \u2013 Wordpress Gym Management System plugin up to and including version 67.7.0. Any WordPress site using the plugin, whether a single\u2011site or multisite network, is potentially impacted. The plugin is distributed by dasinfomedia under the WPGYM product name.", "description_and_impact": "The WPGYM plugin is vulnerable to Local File Inclusion through the \"page\" parameter. An authenticated user with Subscriber-level access and above can include and execute arbitrary files on the server. Because the vulnerable files can be uploaded as seemingly safe types, an attacker can execute any PHP code. This ability can be used to bypass access controls, read sensitive data, or launch further attacks. In Multisite environments, the LFI can be chained to a dashboard view file that updates the password of Super Administrator accounts, providing a direct path to privilege escalation.", "risk_and_exploitability": "The CVSS score of 8.8 indicates high severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA\u2019s KEV catalog. Attackers must be authenticated with at least Subscriber privileges and must supply a crafted \"page\" parameter value. Once the inclusion succeeds, the attacker can execute arbitrary PHP, potentially compromising the host and escalating privileges by altering Super Admin passwords in Multisite sites."}}}}, "created": "2025-08-24T22:19:15.398692+00:00", "updated": "2026-04-22T01:00:04.365688+00:00", "vendors": ["dasinfomedia", "dasinfomedia$PRODUCT$wpgym_gym_management_system", "wordpress", "wordpress$PRODUCT$wordpress"]}