CVE-2025-6080: WPGYM WordPress Auth Bypass Vulnerability

CVE-2025-6080 Overview

CVE-2025-6080 is a privilege escalation vulnerability in the WPGYM - WordPress Gym Management System plugin. The flaw affects all versions up to and including 67.7.0. The plugin fails to validate a user's capabilities before adding new users to the WordPress site. Authenticated attackers with Subscriber-level access or higher can create new accounts, including administrator accounts. The issue is classified under CWE-269: Improper Privilege Management.

Critical Impact
Any low-privileged authenticated user can elevate to full administrator, leading to complete WordPress site takeover, content modification, and code execution through plugin or theme uploads.

Affected Products

WPGYM - WordPress Gym Management System plugin (all versions ≤ 67.7.0)
WordPress sites running WPGYM with open user registration or any Subscriber-level account
Hosting environments distributing the CodeCanyon WPGYM package

Discovery Timeline

2025-08-16 - CVE-2025-6080 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-6080

Vulnerability Analysis

The WPGYM plugin exposes a user-creation handler accessible to authenticated WordPress users. The handler accepts user-supplied parameters that define the new account, including the role. Because the handler does not call current_user_can() or equivalent capability checks before invoking wp_insert_user(), any logged-in user can submit a request that creates an account with the administrator role.

Once an attacker controls an administrator account, they can install arbitrary plugins, modify theme files, execute PHP, exfiltrate data from the WordPress database, and pivot into the underlying host. The vulnerability requires authentication but the bar is low because Subscriber accounts can often be created through the standard WordPress registration form when it is enabled.

Root Cause

The root cause is missing authorization in the user-creation AJAX or REST endpoint registered by WPGYM. The plugin treats the action as available to any authenticated session and does not enforce role-based access control on the role parameter. This maps directly to CWE-269, improper privilege management, where a function intended for administrators is callable by lower-privileged users.

Attack Vector

The attack vector is network-based and requires only Subscriber-level authentication. An attacker registers a free Subscriber account or compromises any existing low-privilege credential. They then send a crafted request to the vulnerable WPGYM endpoint specifying a new username, password, email, and the administrator role. The plugin inserts the user, and the attacker logs in with full administrative privileges. No user interaction from a site administrator is required. Refer to the Wordfence Vulnerability Intel entry for additional technical context.

Detection Methods for CVE-2025-6080

Indicators of Compromise

New WordPress users with the administrator role created in close time proximity to Subscriber account registration
Unexpected entries in the wp_users and wp_usermeta tables where wp_capabilities is set to administrator
POST requests from Subscriber sessions to WPGYM AJAX actions or REST routes referencing user creation
Plugin or theme uploads, file edits, or option changes performed by newly created administrator accounts

Detection Strategies

Audit the WordPress users table for administrator accounts created after the WPGYM plugin was installed
Correlate web server access logs for admin-ajax.php or wp-json requests tied to WPGYM endpoints originating from low-privileged sessions
Enable WordPress audit logging plugins to capture user_register and role-change events with the acting user ID

Monitoring Recommendations

Forward WordPress and web server logs to a SIEM and alert on administrator role assignments
Monitor for spikes in wp-login.php registrations followed by privileged actions from the same IP
Track plugin and theme installation events, which are common post-exploitation activities for this class of flaw

How to Mitigate CVE-2025-6080

Immediate Actions Required

Update the WPGYM - WordPress Gym Management System plugin to a version newer than 67.7.0 once the vendor publishes a fix
Disable open user registration by unchecking Settings → General → "Anyone can register" until patched
Review all administrator accounts and remove any that are unauthorized, then rotate credentials for remaining admins
Rotate WordPress secret keys in wp-config.php to invalidate active sessions of any attacker-created accounts

Patch Information

No vendor patch is referenced in the NVD record at the time of publication. Consult the CodeCanyon WPGYM product page and the Wordfence advisory for the latest patch status. Apply the fixed version as soon as it becomes available.

Workarounds

Deactivate and remove the WPGYM plugin until a patched release is available
Block requests to WPGYM AJAX actions and REST routes at the web application firewall for non-administrator sessions
Restrict access to /wp-admin/admin-ajax.php and /wp-json/ from low-trust IP ranges where feasible
Enforce strong password and multi-factor authentication on all WordPress accounts to limit Subscriber-level compromise

bash

# Example: disable WordPress open registration via WP-CLI
wp option update users_can_register 0

# List all administrator accounts to audit for unauthorized entries
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered