CVE-2025-39395CWE-89

WordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerability

Critical 路 published May 19, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
29.6
In the wild
Unconfirmed
What it is

馃敟 A single unfiltered input could turn your database into an open book! This SQL injection vulnerability in mojoomla WPAMS lets attackers wreak havoc on installations from n/a up to version 44.0! Think of it like a restaurant that takes orders without checking the menu first; if a diner can slip in any dish they want, chaos ensues in the kitchen! This SQL injection flaw allows anyone to inject malicious commands as if they鈥檙e part of the original recipe, and that can lead to total data meltdowns. An attacker could potentially read sensitive user data, modify records, or even delete everything from the database. It鈥檚 like letting a mischievous child run wild in a candy store where every candy is made of critical data! The results could be absolutely devastating for your users and your business.

Put simply

Think of it like a restaurant that takes orders without checking the menu first; if a diner can slip in any dish they want, chaos ensues in the kitchen! This SQL injection flaw allows anyone to inject malicious commands as if they鈥檙e part of the original recipe, and that can lead to total data meltdowns. This vulnerability arises from improper neutralization of special elements in SQL commands, allowing attackers to insert or manipulate commands via unsanitized input. The affected versions of mojoomla WPAMS are vulnerable to direct SQL injection attacks.

What to do

An attacker could potentially read sensitive user data, modify records, or even delete everything from the database. It鈥檚 like letting a mischievous child run wild in a candy store where every candy is made of critical data! The results could be absolutely devastating for your users and your business. Immediately update mojoomla WPAMS to the latest version beyond 44.0. Additionally, ensure all user inputs are properly sanitized and use prepared statements to shield your database from malicious injections. Regular audits of your code can help spot vulnerabilities before they鈥檙e exploited. You've got this! Follow these steps to secure your application, and soon you'll be a security hero! 馃Ω鈥嶁檪锔忦煕★笍

The record
Technical detail
CVSS v3.1
9.3 路 CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00368 路 29.6th percentile
Weakness
CWE-89 路 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-05-19T19:27Z
EPSS history
Timeline
  • 19 MAY 19:27Z
    WordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerability
    cvelistv5