CVE-2024-9941

Summary

CVE-2024-9941 is a privilege escalation vulnerability affecting the Wordpress Gym Management System plugin, specifically the MJ_gmgt_add_staff_member() function, in versions up to 67.1.0. Authenticated attackers with subscriber-level access or higher can exploit this flaw to create new user accounts with administrative privileges, bypassing the necessary capability checks. This poses a significant risk, as unauthorized administrator accounts can lead to extensive damage in terms of data breaches, unauthorized changes to settings, and other malicious activities. WP users are advised to update the plugin as soon as possible to mitigate this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.