This vulnerability in mojoomla WPAMS (up to version 44.0) involves improper neutralization of special elements used in SQL commands, classified as an SQL Injection flaw. It allows an attacker with low privileges and no user interaction to execute crafted SQL commands that can compromise confidentiality with limited impact on availability. The CVSS vector indicates network attack vector, low attack complexity, and no user interaction required. The vulnerability was reserved in April 2025 and published in May 2025. No patch or vendor advisory is currently available.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (confidentiality impact is high). Integrity impact is not indicated, and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are documented at this time.