This vulnerability (CVE-2025-32643) in mojoomla WPGYM is classified as CWE-89, indicating improper neutralization of special elements used in SQL commands, leading to Blind SQL Injection. The flaw allows remote attackers to inject SQL queries without authentication, potentially exposing sensitive data. The affected versions include WPGYM up to 65.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) highlights network attack vector, low attack complexity, no privileges or user interaction required, with a scope change and high confidentiality impact but no integrity impact and low availability impact. No patch or vendor advisory is currently available.

An attacker can exploit this vulnerability remotely without authentication or user interaction to perform Blind SQL Injection attacks. This can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). The integrity of data is not impacted, and availability impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as restricting access to the affected plugin or disabling it if possible. Monitor official mojoomla channels for updates and patches.