The mojoomla WPAMS apartment-management plugin suffers from an SQL Injection vulnerability (CVE-2025-39395) caused by improper neutralization of special elements used in SQL commands. This flaw affects all versions up to 44.0 (dated 17-08-2023). The vulnerability allows remote attackers to execute SQL injection attacks without authentication or user interaction, potentially leading to a complete compromise of confidentiality. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), reflecting critical severity with high confidentiality impact and low availability impact. No patch or vendor advisory is provided in the available data, and no exploits are currently known in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform SQL injection attacks against the WPAMS plugin, potentially leading to unauthorized disclosure of sensitive information from the database. The impact is rated critical due to the high confidentiality impact and the lack of required privileges or user interaction. Availability impact is low, and integrity impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected WPAMS plugin to mitigate risk. Monitor official mojoomla channels for updates and patches addressing this vulnerability.