The vulnerability CVE-2025-39402 in mojoomla WPAMS is an unrestricted file upload issue that permits authenticated users with low privileges to upload files with dangerous types, such as web shells, to the web server. This can lead to complete compromise of the affected system. The CVSS 3.1 base score is 9.9 (critical), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions include all WPAMS versions up to 44.0 released on August 17, 2023. There is no vendor advisory or patch link available at this time.

Successful exploitation allows an attacker with low privileges to upload and execute arbitrary code on the web server, potentially leading to full system compromise. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability is critical with a CVSS score of 9.9. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload functionality to trusted users only and monitor for suspicious file uploads. Avoid exposing the vulnerable plugin on publicly accessible servers if possible.