The vulnerability CVE-2025-24773 affects the mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce plugin up to version 3.2.0. It is caused by improper neutralization of special elements used in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the affected system. This can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector. The vulnerability does not require user interaction or privileges, increasing the risk of exploitation. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the mojoomla vendor channels for updates. In the meantime, restricting access to the affected plugin and limiting exposure to untrusted networks may reduce risk. Avoid using affected versions of the plugin until a fix is available.