CVE-2024-9941: Privilege Escalation in WPGYM WordPress Plugin

The impact of this vulnerability is significant. An attacker, already logged in with a subscriber account, can bypass access controls and create a new administrator account. This grants them complete control over the WordPress site, including access to sensitive data, the ability to modify content, install malicious plugins, and potentially compromise the entire system. This effectively allows an attacker to gain full administrative privileges without needing to crack passwords or exploit other vulnerabilities. The ease of exploitation, requiring only subscriber access, significantly broadens the attack surface.

1. Reserved2024-10-14
2. Published2024-11-23
3. Modified2024-11-24
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-9941 is to immediately upgrade the WPGYM plugin to a version that includes the security fix. If upgrading is not immediately feasible due to compatibility concerns or breaking changes, consider restricting user roles and permissions within WordPress to limit the potential impact of a successful attack. Implement strict access controls and regularly audit user accounts. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block suspicious activity related to user creation. After upgrading, verify the fix by attempting to create a new user account with administrator privileges using a subscriber account – the action should be denied.