The vulnerability CVE-2025-39401 in mojoomla WPAMS allows attackers to upload files of dangerous types without restriction, including web shells, which can lead to remote code execution on the affected web server. This affects all versions up to 44.0 (as of 17-08-2023). The CVSS 3.1 base score is 10.0, reflecting a critical severity with network attack vector, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability. No patch or remediation details are currently provided by the vendor. The vulnerability is publicly known and published, but no known exploits have been reported in the wild.

Successful exploitation allows an unauthenticated attacker to upload and execute arbitrary malicious files such as web shells on the target server, potentially leading to full system compromise including data theft, modification, or destruction, and disruption of service. The vulnerability has a critical CVSS score of 10.0, indicating maximum impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions, implement strict file type validation, and consider disabling file upload functionality if not required. Monitor vendor communications for patches or official mitigations.