CVE-2024-9941 is a privilege escalation vulnerability in the dasinfomedia WPGYM Wordpress plugin. The issue arises from the absence of a capability check in the MJ_gmgt_add_staff_member() function, allowing authenticated users with low privileges (subscriber level and above) to create new users with administrator roles. This flaw affects all versions up to 67.1.0 and has a CVSS 3.1 base score of 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official fix has been published yet, and the plugin is not a cloud service, so remediation depends on vendor updates or manual mitigation.

An attacker with subscriber-level access can escalate privileges to administrator by creating new admin accounts. This compromises the entire Wordpress site managed by the plugin, potentially allowing full control over site content, configuration, and user management. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor for suspicious account creation activities. Consider disabling or removing the WPGYM plugin if administrative control cannot be assured.