CVE-2024-9941: WPGYM Privilege Escalation Vulnerability

CVE-2024-9941 Overview

CVE-2024-9941 is a privilege escalation vulnerability in the WPGYM - WordPress Gym Management System plugin developed by Mojoomla. The flaw exists in the MJ_gmgt_add_staff_member() function, which lacks a proper capability check. Authenticated attackers with subscriber-level access or higher can invoke this function to create new user accounts assigned the administrator role. All plugin versions up to and including 67.1.0 are affected. Successful exploitation grants full administrative control of the WordPress site, enabling content modification, plugin installation, and further compromise of the hosting environment.

Critical Impact
Any authenticated subscriber can create an administrator account and take full control of the affected WordPress site.

Affected Products

Mojoomla WPGYM - WordPress Gym Management System, all versions through 67.1.0
WordPress installations with the WPGYM plugin active
Sites distributing the plugin via CodeCanyon marketplace

Discovery Timeline

2024-11-23 - CVE-2024-9941 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9941

Vulnerability Analysis

The vulnerability is a broken access control flaw classified under [CWE-269] (Improper Privilege Management) and [CWE-862] (Missing Authorization). The plugin exposes the MJ_gmgt_add_staff_member() function without validating whether the calling user holds the appropriate WordPress capability. WordPress typically restricts staff and user creation to administrators through the create_users or edit_users capabilities. Because the function omits these checks, any authenticated session can trigger user creation. The attacker supplies role parameters during the request, allowing selection of the administrator role. Once the new administrator account is created, the attacker authenticates directly and bypasses all plugin-level and site-level restrictions.

Root Cause

The root cause is a missing capability check inside the MJ_gmgt_add_staff_member() handler. The function accepts input for user creation without invoking current_user_can() or an equivalent capability gate. It also lacks role-scoping logic to prevent low-privileged users from assigning elevated roles.

Attack Vector

Exploitation requires network access and a valid subscriber-level account. The attacker submits a crafted request to the endpoint that invokes MJ_gmgt_add_staff_member(), supplying user credentials and the target role in the request parameters. The plugin processes the request and inserts the new administrator account into the WordPress user database. No user interaction from a legitimate administrator is required. See the Wordfence Vulnerability Report for the disclosure details.

Detection Methods for CVE-2024-9941

Indicators of Compromise

Unexpected new WordPress user accounts assigned the administrator role
POST requests to WPGYM plugin endpoints originating from subscriber-level sessions
Entries in the wp_users and wp_usermeta tables created outside standard administrative workflows
Login events from newly created administrator accounts shortly after their creation

Detection Strategies

Audit the WordPress user list for accounts created after the plugin was installed and correlate against known administrator provisioning activity
Enable WordPress audit logging to record calls to user creation functions and role assignments
Inspect web server access logs for requests to admin-ajax.php or plugin routes referencing MJ_gmgt_add_staff_member or add_staff_member

Monitoring Recommendations

Alert on any privilege change events that promote a user to the administrator role
Monitor authentication logs for first-time logins from accounts created within the last 24 hours
Track HTTP request volume from subscriber accounts to plugin AJAX endpoints and flag anomalies

How to Mitigate CVE-2024-9941

Immediate Actions Required

Deactivate the WPGYM plugin until a patched release is confirmed available from the vendor
Review all WordPress user accounts and remove any unauthorized administrator entries
Reset passwords for existing administrator accounts and enforce multi-factor authentication
Restrict new user registration on the site if the community requires only trusted authors

Patch Information

At the time of NVD publication, no fixed version beyond 67.1.0 is documented in the referenced advisories. Site owners should monitor the Wordfence Vulnerability Report and the CodeCanyon plugin listing for updated releases from Mojoomla and apply them immediately upon availability.

Workarounds

Restrict access to the WordPress /wp-admin/admin-ajax.php endpoint using a web application firewall rule that blocks requests targeting WPGYM staff creation actions from non-administrator sessions
Disable subscriber-level registration until the plugin is patched or removed
Apply a virtual patching rule that inspects requests for the MJ_gmgt_add_staff_member action and enforces capability verification at the WAF layer

bash

# Example WordPress WP-CLI commands to audit and remediate administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp user delete <suspicious_user_id> --reassign=1
wp plugin deactivate wpgym