Mojoomla provides WordPress-based gym and fitness management plugins, with vulnerabilities concentrated in access-control and file-handling mechanisms that are endemic to third-party WordPress extensions managing user roles and uploads. The recurring weakness classes include improper privilege management, missing authorization, and unrestricted file uploads, reflecting the common security gaps in plugin code that interfaces with WordPress's authentication layer. Current exploitation activity, severity breakdown, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Mojoomla over time
Signals from CVEs in this vendor scope (2 CVEs).
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-9942CRITICAL The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the MJ_gmgt_user_avatar_image_upload | Nov 23, 2024 | 9.8 | 30 | NO | NO |
CVE-2024-9941HIGH The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the MJ_gmgt_add_staff_member() function | Nov 23, 2024 | 8.8 | 25 | NO | NO |
Signals from CVEs in this vendor scope (2 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Mojoomla.
Media articles that mention a CVE ID that affects a product developed by Mojoomla — matched by CVE ID, not by vendor name.