The lomart.fr UP plugin for Joomla contains multiple SQL injection vectors in versions 5.0.0-5.2.0 and 6.0.0-6.0.29. This vulnerability is classified under CWE-89, indicating improper neutralization of special elements used in SQL commands. The CVSS 4.0 score is 8.3, reflecting a high-severity remote vulnerability that requires no privileges or user interaction but involves partial attack complexity and partial impact on confidentiality and availability. The vulnerability could allow attackers to execute unauthorized SQL commands against the backend database.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the affected Joomla plugin's database. This may lead to unauthorized data access, modification, or deletion, impacting confidentiality and availability of the system. However, no active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.