The vulnerability CVE-2025-39406 in mojoomla WPAMS arises from improper validation or control over filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion, potentially enabling arbitrary file disclosure or code execution within the context of the affected application. The issue affects all WPAMS versions up to 44.0. The CVSS 3.1 score of 9.8 reflects that the vulnerability is remotely exploitable without privileges or user interaction and can lead to complete compromise of confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the server, potentially leading to sensitive information disclosure, remote code execution, or full system compromise. The critical CVSS score indicates severe impact on the affected system's security posture.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider restricting access to the affected application and monitor for suspicious activity related to file inclusion attempts.