WPGYM WordPress Plugin Unauthorized Admin Account Creation Vulnerability

A vulnerability exists in the WPGYM - WordPress Gym Management System plugin, affecting all versions through 67.7.0. The issue arises from the plugin's failure to properly validate user capabilities before adding new users. This flaw allows authenticated attackers with Subscriber-level access or higher to create new user accounts, including those with admin privileges.

Impact

Exploitation of this vulnerability allows for unauthorized creation of admin accounts, potentially leading to further malicious actions within the WordPress site.

Remediation

No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.