WPGYM <=67.1.0 Privilege Escalation via Missing Authorization

Based on the screenshot from this webpage, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: WPGYM <= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation 2. Affected Software: WPGYM - Wordpress Gym Management System 3. Vulnerability Type: Improper Privilege Management 4. CVSS Score: 8.8 (High) 5. Public Disclosure Date: November 22, 2024 6. Last Updated Date: November 23, 2024 7. Researcher: Tonn 8. Patch Status: Patched 9. Affected Versions: <= 67.1.0 10. Fixed Version: 67.2.0 11. Vulnerability Description: Due to the lack of authorization checks for the function in all versions of WPGYM up to 67.1.0, a privilege escalation vulnerability exists. An attacker with Subscriber privileges or higher can exploit this vulnerability to create new user accounts with administrator privileges. 12. Reference Link: codecanyon.net 13. Vulnerability Database: Wordfence Intelligence Vulnerability Database 14. Vulnerability Score: 8.8 (High) 15. Public Disclosure Date: November 22, 2024 16. Vulnerability Update Date: November 23, 2024 17. Researcher: Tonn 18. Patch Status: Patched 19. Affected Versions: <= 67.1.0 20. Fixed Version: 67.2.0 21. Vulnerability Description: As above. 22. Reference Link: codecanyon.net 23. Vulnerability Database: Wordfence Intelligence Vulnerability Database 24. Vulnerability Score: 8.8 (High) 25. Public Disclosure Date: November 22, 2024 26. Vulnerability Update Date: November 23, 2024 27. Researcher: Tonn 28. Patch Status: Patched 29. Affected Versions: <= 67.1.0 30. Fixed Version: 67.2.0 31. Vulnerability Description: As above. 32. Reference Link: codecanyon.net 33. Vulnerability Database: Wordfence Intelligence Vulnerability Database 34. Vulnerability Score: 8.8 (High) 35. Public Disclosure Date: November 22, 2024 36. Vulnerability Update Date: November 23, 2024 37. Researcher: Tonn 38. Patch Status: Patched 39. Affected Versions: <= 67.1.0 40. Fixed Version: 67.2.0 41. Vulnerability Description: As above. 42. Reference Link: codecanyon.net 43. Vulnerability Database: Wordfence Intelligence Vulnerability Database 44. Vulnerability Score: 8.8 (High) 45. Public Disclosure Date: November 22, 2024 46. Vulnerability Update Date: November 23, 2024 47. Researcher: Tonn 48. Patch Status: Patched 49. Affected Versions: <= 67.1.0 50. Fixed Version: 67.2.0 51. Vulnerability Description: As above. 52. Reference Link: codecanyon.net 53. Vulnerability Database: Wordfence Intelligence Vulnerability Database 54. Vulnerability Score: 8.8 (High) 55. Public Disclosure Date: November 22, 2024 56. Vulnerability Update Date: November 23, 2024 57. Researcher: Tonn 58. Patch Status: Patched 59. Affected Versions: <= 67.1.0 60. Fixed Version: 67.2.0 61. Vulnerability Description: As above. 62. Reference Link: codecanyon.net 63. Vulnerability Database: Wordfence Intelligence Vulnerability Database 64. Vulnerability Score: 8.8 (High) 65. Public Disclosure Date: November 22, 2024 66. Vulnerability Update Date: November 23, 2024 67. Researcher: Tonn 68. Patch Status: Patched 69. Affected Versions: <= 67.1.0 70. Fixed Version: 67.2.0 71. Vulnerability Description: As above. 72. Reference Link: codecanyon.net 73. Vulnerability Database: Wordfence Intelligence Vulnerability Database 74. Vulnerability Score: 8.8 (High) 75. Public Disclosure Date: November 22, 2024 76. Vulnerability Update Date: November 23, 2024 77. Researcher: Tonn 78. Patch Status: Patched 79. Affected Versions: <= 67.1.0 80. Fixed Version: 67.2.0 81. Vulnerability Description: As above. 82. Reference Link: codecanyon.net 83. Vulnerability Database: Wordfence Intelligence Vulnerability Database 84. Vulnerability Score: 8.8 (High) 85. Public Disclosure Date: November 22, 2024 86. Vulnerability Update Date: November 23, 2024 87. Researcher: Tonn 88. Patch Status: Patched 89. Affected Versions: <= 67.1.0 90. Fixed Version: 67.2.0 91. Vulnerability Description: As above. 92. Reference Link: codecanyon.net 93. Vulnerability Database: Wordfence Intelligence Vulnerability Database 94. Vulnerability Score: 8.8 (High) 95. Public Disclosure Date: November 22, 2024 96. Vulnerability Update Date: November 23, 2024 97. Researcher: Tonn 98. Patch Status: Patched 99. Affected Versions: <= 67.1.0 100. Fixed Version: 67.2.0 101. Vulnerability Description: As above. 102. Reference Link: codecanyon.net 103. Vulnerability Database: Wordfence Intelligence Vulnerability Database 104. Vulnerability Score: 8.8 (High) 105. Public Disclosure Date: November 22, 2024 106. Vulnerability Update Date: November 23, 2024 107. Researcher: Tonn 108. Patch Status: Patched 109. Affected Versions: <= 67.1.0 110. Fixed Version: 67.2.0 111. Vulnerability Description: As above. 112. Reference Link: codecanyon.net 113. Vulnerability Database: Wordfence Intelligence Vulnerability Database 114. Vulnerability Score: 8.8 (High) 115. Public Disclosure Date: November 22, 2024 116. Vulnerability Update Date: November 23, 2024 117.

Goal Reached Thanks to every supporter — we hit 100%!

WPGYM <=67.1.0 Privilege Escalation via Missing Authorization