How to fix CVE-2025-7442?

Within 24 hours: Identify all WordPress instances running WPGYM plugin and document current versions. Within 7 days: Apply the vendor-released patch to all affected WPGYM installations and verify successful deployment. Within 30 days: Conduct database access logs review for suspicious SQL queries and consider security scanning of affected WordPress environments.

Is PHP affected by CVE-2025-7442?

WPGYM WordPress plugin contains a SQL injection vulnerability (CVSS 7.5) that could allow attackers to access or manipulate gym member databases and sensitive operational data.

CVE-2025-7442

EUVD-2025-21115 HIGH

2025-07-11 [email protected]

WordPress SQLi PHP Information Disclosure

7.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:27 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

patch_available

Apr 16, 2026 - 05:29 EUVD

67.8.0

Analysis Generated

Mar 16, 2026 - 08:17 vuln.today

EUVD ID Assigned

Mar 16, 2026 - 08:17 euvd

EUVD-2025-21115

CVE Published

Jul 11, 2025 - 08:15 nvd

HIGH 7.5

DescriptionNVD

The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to SQL Injection via several parameters in the MJ_gmgt_delete_class_limit_for_member, MJ_gmgt_get_yearly_income_expense, MJ_gmgt_get_monthly_income_expense, MJ_gmgt_add_class_limit, MJ_gmgt_view_meeting_detail, and MJ_gmgt_create_meeting functions in all versions up to 67.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

A SQL injection vulnerability in WPGYM - Wordpress Gym Management System (CVSS 7.5). High severity vulnerability requiring prompt remediation.

Technical ContextAI

CWE-89 (SQL Injection). CVSS 7.5 indicates high severity. Affects WPGYM - Wordpress Gym Management System.

RemediationAI

Monitor vendor channels for patch availability. Implement input validation and WAF rules as interim mitigation.

CVE-2025-7442 vulnerability details – vuln.today

Back

CVE-2025-7442

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code