Joomla Extensions: Two Critical SQLi and Two Medium Flaws Disclosed Together
Key findings • Two critical SQL injection vulnerabilities disclosed in Joomla extensions Page Builder CK and Phoca Cart. • Medium-severity ACL bypass and CSRF flaws found in iCagenda extensio…
Key findings
- Two critical SQL injection vulnerabilities disclosed in Joomla extensions Page Builder CK and Phoca Cart.
- Medium-severity ACL bypass and CSRF flaws found in iCagenda extension.
- Vulnerabilities affect versions prior to Page Builder CK 3.6.5, Phoca Cart 6.1.6, and iCagenda 2.0.0-4.0.11.
- Patches are available for the affected extensions, emphasizing the need for prompt updates.
On August 14-17, 2026, a batch of four vulnerabilities was disclosed for Joomla extensions, with two critical SQL injection flaws and two medium-severity issues impacting access control and security. These vulnerabilities affect popular extensions from joomlack.fr, phoca.cz, and icagenda.com, highlighting potential risks for Joomla site administrators and users.
Two critical SQL injection vulnerabilities were discovered in widely used Joomla extensions. CVE-2026-74254, affecting Page Builder CK versions prior to 3.6.5, allows for SQL injection through the styles model. This vulnerability was patched in versions 3.6.4 (frontend) and 3.6.5 (backend). Additionally, CVE-2026-74251, found in Phoca Cart versions 5.0.0 through 6.1.6, enables unauthenticated SQL injection via the a[] and s[] GET parameters on the shop items page. These parameters are directly concatenated into SQL queries without proper sanitization, posing a significant risk to data integrity.
Beyond the critical SQL injection flaws, two medium-severity vulnerabilities were also disclosed. CVE-2026-71570 and CVE-2026-67366, both affecting iCagenda versions prior to 2.0.0-4.0.11, were reported by the same vendor. CVE-2026-71570 involves an Access Control List (ACL) bypass, allowing backend operators with limited com_icagenda permissions to enumerate arbitrary Joomla user profiles. CVE-2026-67366 addresses a Cross-Site Request Forgery (CSRF) vulnerability in frontend registration actions, where state-changing operations could be performed without a CSRF token check.
The disclosure of these vulnerabilities underscores the importance of timely updates for third-party Joomla extensions. While patches are available for Page Builder CK and Phoca Cart, users of iCagenda should ensure they are running version 2.0.0-4.0.11 or later to mitigate the ACL bypass and CSRF risks. Administrators are advised to review their installed extensions and apply updates promptly to protect their Joomla websites from potential exploitation.
This batch of vulnerabilities, disclosed over a three-day period, highlights the ongoing need for vigilance in securing Joomla websites, particularly those relying on third-party extensions for enhanced functionality. The presence of critical SQL injection flaws alongside access control and CSRF issues indicates a broad range of potential attack vectors that could be exploited if systems are not kept up-to-date. Staying informed about security advisories and applying patches swiftly remains the most effective defense against such threats.