The vulnerability CVE-2025-24773 in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce arises from improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. It affects all versions up to 3.2.0. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. This allows remote attackers to execute unauthorized SQL commands potentially compromising sensitive data confidentiality. The vulnerability is published and tracked by Patchstack but no patch or fix links are currently available.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information stored in the database. The confidentiality impact is high, while integrity is not impacted and availability impact is low. This could compromise the privacy of data managed by the affected CRM plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or restricting access to it to trusted users only. Monitor official mojoomla communications and Patchstack advisories for updates on patches or mitigations.