The vulnerability CVE-2026-39433 affects mojoomla WPAMS before version 49.5.3. It involves missing authorization controls that permit subscriber-level users to delete arbitrary content. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates the attack can be performed remotely over the network with low attack complexity, requiring low privileges (subscriber level), no user interaction, and results in a high impact on availability without affecting confidentiality or integrity. No official patch or remediation level has been provided in the available data.

Exploitation of this vulnerability allows authenticated subscribers to delete arbitrary content, causing denial of service or data loss impacting availability. There is no direct impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor mojoomla's official channels for updates. Until a patch is available, restricting subscriber permissions or disabling affected functionality may reduce risk.