Joomla: 17 Vulnerabilities Disclosed, Including Critical Code & SQL Injection Flaws
A batch of 17 vulnerabilities affecting Joomla and its extensions were disclosed between August 14-19, 2026, including critical code injection and SQL injection flaws.
Key findings
- 17 vulnerabilities disclosed for Joomla and its extensions between August 14-19, 2026.
- Critical PHP Code Injection in Balbooa Forms (CVE-2026-67364) and SQL Injection in Page Builder CK (CVE-2026-74254) and Phoca Cart (CVE-2026-74251).
- Multiple Joomla core vulnerabilities include ACL bypasses, XSS, MFA bypass, and unrestricted file uploads.
- Affected versions range from older Joomla 3.x to the latest Joomla 5.x and 6.x, plus specific extension versions.
- Patches are available for Balbooa Forms, Page Builder CK, Phoca Cart, iCagenda, and Joomla core.
On August 19, 2026, a significant batch of 17 vulnerabilities affecting Joomla and its extensions was disclosed, spanning a disclosure window from August 14 to August 19. This cluster includes critical and high-severity flaws, with a particular focus on PHP code injection, SQL injection, and authentication bypass vulnerabilities. The disclosures highlight risks for Joomla site administrators and users, emphasizing the need for prompt updates to secure websites.
A critical PHP Code Injection vulnerability (CVE-2026-67364) was found in Balbooa Forms versions prior to 2.4.3.2. This flaw, with a CVSS score of 9.8, allows pre-authentication attackers to inject and execute arbitrary PHP code by exploiting the optional custom-PHP post-submission handler, which incorrectly uses eval() on user-supplied data. In tandem, a high-severity Payment Amount Tampering vulnerability (CVE-2026-67363) was also identified in the same extension, allowing attackers to manipulate payment amounts before they are processed by the payment gateway.
Several critical SQL injection vulnerabilities were disclosed in Joomla extensions. CVE-2026-74254, affecting Page Builder CK versions prior to 3.6.5, allows SQL injection through the styles model. Similarly, CVE-2026-74251 in Phoca Cart (versions 5.0.0-6.1.6) enables unauthenticated SQL injection via attribute and specification GET parameters, directly concatenating them into SQL WHERE clauses without proper sanitization.
Joomla's core system was also impacted by multiple medium-severity vulnerabilities. These include improper ACL checks for various operations such as injecting schema.org contact data (CVE-2026-73372), creating custom fields via webservice endpoints (CVE-2026-72531), and performing batch copy operations on uneditable items (CVE-2026-73371). Additionally, Cross-Site Scripting (XSS) through schema.org outputs (CVE-2026-73336), improper CORS origin validation (CVE-2026-71573), and response header injection in download views (CVE-2026-71572) were reported. A notable high-severity vulnerability in Joomla Core is CVE-2026-73373, which allows unrestricted uploads of SHTML files due to an incomplete list of dangerous file types, potentially leading to code execution. Another high-severity core vulnerability, CVE-2026-73337, permits MFA authentication bypass due to insufficient state checks. Inconsistent ACL checks for mutating webservice endpoints (CVE-2026-71574) also present a risk, allowing unauthorized mutations where the backend UI restricts them.
The extension iCagenda was affected by three medium-severity vulnerabilities: an ACL bypass allowing arbitrary user enumeration (CVE-2026-71570), Cross-Site Request Forgery (CSRF) on frontend registration actions (CVE-2026-67366), and an authenticated SQL injection via an unescaped numeric filter (CVE-2026-71571).
The disclosed vulnerabilities affect a wide range of Joomla versions, from older Joomla 3.x installations to the latest Joomla 5.x and 6.x releases, as well as specific versions of affected extensions. Patches and updates are available for the affected extensions, including Balbooa Forms (2.4.3.2), Page Builder CK (3.6.5), Phoca Cart (6.1.6), and iCagenda (2.0.0-4.0.11). Joomla core updates addressing the reported issues are also recommended. Users are strongly advised to apply these updates promptly to mitigate the risks associated with these vulnerabilities.
This extensive batch of vulnerabilities underscores the importance of maintaining up-to-date Joomla installations and extensions. The presence of critical code injection and SQL injection flaws, particularly in widely used extensions, presents a significant attack surface. Administrators should prioritize patching these vulnerabilities to prevent potential data breaches, website defacement, or complete system compromise. Continuous monitoring for security advisories from Joomla and its extension developers remains crucial for ongoing site security.