WPAMS WordPress Plugin EUVD-2026-37468

Exploitation requires a subscriber-level WordPress account on the target site - confirmed by the CVSS PR:L metric. This is the default lowest authenticated role in WordPress and can be obtained via self-registration on sites with open registration enabled. The target site must be running WPAMS by Mojoomla in a version prior to 49.5.3. No special plugin configuration or non-default settings are required beyond the plugin being active. Exploitation is limited by the need for at least a subscriber account - unauthenticated visitors cannot exploit this. Sites with closed user registration or with no publicly accessible registration form significantly reduce the exploitable population to internal users and existing account holders.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects a moderate-to-high severity issue where the attack vector is network-based, complexity is low, and the required privilege is minimal (subscriber). The impact is purely on availability - content is deleted and lost, with no confidentiality or integrity signal in the vector. There is no KEV listing and no disclosed proof-of-concept, which reduces immediate urgency. However, the low access complexity and minimal privilege requirement mean any registered user of a WPAMS-enabled site could exploit this, making it a realistic insider or low-effort threat on sites with open user registration. EPSS data was not provided; given the niche WordPress plugin scope, real-world exploitation probability is likely low but non-zero for targeted attacks against property management sites. This is a genuine priority for affected deployments, not a theoretical risk inflated by CVSS alone.

An attacker registers a free subscriber account on a WordPress site running WPAMS prior to 49.5.3, then crafts an authenticated HTTP request targeting the plugin's content deletion endpoint - bypassing the absent authorization check. Without requiring any elevated privileges or administrator interaction, the attacker can systematically delete apartment listings, tenant records, or other managed content, causing significant availability and operational damage to the property management site. No public proof-of-concept has been identified, but the attack pattern is straightforward given the missing capability check.