CVE-2025-7442 is an SQL Injection vulnerability in the dasinfomedia WPGYM Wordpress plugin affecting several functions (MJ_gmgt_delete_class_limit_for_member, MJ_gmgt_get_yearly_income_expense, MJ_gmgt_get_monthly_income_expense, MJ_gmgt_add_class_limit, MJ_gmgt_view_meeting_detail, MJ_gmgt_create_meeting). The issue arises from insufficient escaping and lack of prepared statements for user-supplied parameters, enabling unauthenticated attackers to append malicious SQL queries to extract sensitive data. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows unauthenticated attackers to extract sensitive information from the backend database by injecting arbitrary SQL commands. The vulnerability does not impact integrity or availability but compromises confidentiality of data stored by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation.