Joomla hacked?
Joomla 6 migration
Blog
References
About us
Prices
Contact
Since June 2026 the Joomla Project has published 38 vulnerabilities in 28 Joomla extensions – among them JCE, SP Page Builder, Fabrik, iCagenda, AcyMailing and YOOtheme Pro. According to the US cybersecurity agency CISA, two of them are already being actively exploited. Here you will find every vulnerability with the affected versions, as of 21 October 2026, and what you should do now.
Check in five minutes
- In the Joomla backend, look for updates under System → Update → Extensions and install them all – back up first.
- Under System → Manage → Extensions, see which of the extensions below are installed, disabled ones too.
- Uninstall what you no longer need. Depending on the flaw, a disabled extension can still be reachable.
Actively exploited: these two first
The agency CISA keeps a catalogue of vulnerabilities that are known to be attacked. Since this summer it lists these Joomla extensions:
- Page Builder CK (JoomlaCK): File upload without login, leads to PHP code execution · CVSS 10 · actively exploited
- JCE Editor (Widget Factory): Editor profiles can be created without login, leads to PHP code execution · CVSS 10 · actively exploited
Anyone who had one of these extensions in an affected version should not only update but also check the website for foreign files and new users.
Suspect an attack?
Foreign files, redirects to other sites, new administrators: we secure the traces, remove the malware and close the hole.
Joomla hacked? See how we helpAll vulnerabilities since June 2026
The details come from the official CVE records; as a CVE Numbering Authority, the Joomla Project assigns the numbers for Joomla extensions. "Affected up to" names the last affected version according to the record. What counts for the update is the vendor's latest version.
September 2026
- JCTables (JoomCode): SQL injection without login · CVSS 10
- JoomGallery (JoomGallery::friends): File upload without login · CVSS 6.3
- T4 Page Builder (JoomlArt): Open mail relay without login · CVSS 6.9
August 2026
- YOOtheme Pro (YOOtheme): Access to other modules for users with template rights · CVSS 5.1
- YOOtheme Pro (YOOtheme): Stored XSS for privileged users · CVSS 7.5
- Fabrik (Fabrikar): SQL injection without login · CVSS 9.3
- YOOtheme Pro (YOOtheme): SQL injection for logged-in users from author level · CVSS 8.6
- YOOtheme Pro (YOOtheme): File read for privileged users · CVSS 7
- Page Builder CK (JoomlaCK): SQL injection · CVSS 9.3
- Sourcerer (Regular Labs): PHP code execution without login · CVSS 10
- Phoca Cart (Phoca): SQL injection without login · CVSS 9.3
- iCagenda (calendar module) (JoomliC): SQL injection without login · CVSS 9.2
- Cotton Cloud (Tabaoca): File operations for logged-in users (missing access check) · CVSS 5.3
- Cotton Cloud (Tabaoca): File operations without login (missing access check) · CVSS 6.9
July 2026
- SP Page Builder (JoomShaper): SQL injection without login · CVSS 9.2
- SP Page Builder (JoomShaper): SQL injection without login · CVSS 9.2
- EasyStore (JoomShaper): SQL injection without login · CVSS 9.3
- EasyStore (JoomShaper): Other customers' orders and data visible · CVSS 9.2
- EasyStore (JoomShaper): Orders and payment states can be forged without login · CVSS 8.7
- Membership Pro (JoomDonation): Insecure default: media upload without login
- jDownloads (jDownloads): File upload without login, leads to PHP code execution · CVSS 10
- Gridbox (Balbooa): Authentication bypass up to administrator · CVSS 9.4
- DJ-Classifieds (DJ-Extensions): File upload without login, leads to PHP code execution · CVSS 10
- Events Booking (JoomDonation): Insecure default: media upload without login
- ChronoForms 8 (ChronoEngine): Stored XSS without login · CVSS 8.7
- Quix Page Builder Pro (ThemeXpert): SQL injection without login · CVSS 8.7
- EDocman (JoomDonation): SQL injection without login · CVSS 8.7
- DPCalendar (Digital Peak): SQL injection without login · CVSS 8.7
- Phoca Download (Phoca): File upload for registered users, leads to PHP code execution · CVSS 9
- RSFiles! (RSJoomla!): File upload without login, leads to PHP code execution · CVSS 10
- AcyMailing (Acyba): SQL injection · CVSS 9.2
- Balbooa Forms (Balbooa): File upload without login, leads to PHP code execution · CVSS 10
June 2026
- Page Builder CK (JoomlaCK): File upload without login, leads to PHP code execution · CVSS 10 · actively exploited
- Helix3 (JoomShaper): Delete and write files, change template settings without login
- JoomCCK (JoomCoder): SQL injection via the frontend · CVSS 8.7
- iCagenda (JoomliC): File upload via attachments, leads to PHP code execution · CVSS 10
- SP Page Builder (JoomShaper): File upload without login, leads to PHP code execution · CVSS 10
- JCE Editor (Widget Factory): Editor profiles can be created without login, leads to PHP code execution · CVSS 10 · actively exploited
More security updates without a CVE
Not every fixed vulnerability gets a CVE number. According to mySites.guru, these vendors among others have published security updates:
- Regular Labs: large security update for many extensions (including SSRF, command execution, stored XSS)
- JCE: flaw when renaming files, fixed in 2.9.99.10
- Gridbox: numerous critical flaws, fixed in 2.20.2
- YOOtheme ZOO: file upload without login and SQL injection, fixed in 4.1.66
- Fabrik: several flaws without login, fixed in 4.7.2
- Helix Ultimate: security updates in 2.2.7 and 2.2.10
- J2Store: six flaws, including SQL injection without login, fixed in 3.3.23, 4.0.23 and 4.1.8
- SP Page Builder: SQL injection and a bypassable captcha, fixed in 6.9.1
- JEM: five flaws, according to mySites.guru still without a stable fix
Before that: February and March 2026
March 2026
- Astroid Framework (Astroid): File upload without login, leads to PHP code execution · CVSS 10
February 2026
- Tassos Framework (Convert Forms, EngageBox and others) (Tassos): Internal functions callable via com_ajax without access check · CVSS 9.5
Us too: JooAg Shariff
One of our own extensions was affected as well: up to version 8.0.0 the JooAg Shariff plugin had several weaknesses, including XSS, a file readable from outside and unlimited requests. We fixed them in version 8.0.1 and published a security advisory on 19 October 2026.
What the vulnerabilities have in common
- 10 of the 38 vulnerabilities allow PHP code to be smuggled in and executed, mostly through an upload function. Then the website belongs to the attacker.
- 14 are SQL injections: attackers read the database – users, password hashes, customer data.
- 28 need no login. Such flaws are searched for automatically; a small website is not too small a target.
- Widely used extensions are affected: page builders, forms, calendars, shops, download areas and the JCE editor.
How to protect your Joomla website
- Install updates promptly – Joomla shows available updates in the backend. Back up first.
- Remove unused extensions, do not just disable them.
- Check registrations and rights: some flaws only need a simple user account. If you do not need registration, switch it off.
- Keep an eye on the Joomla Project's Vulnerable Extensions List (VEL): it lists extensions for which there is no fix yet.
- Keep Joomla itself up to date – which versions still receive updates is in the overview of all Joomla versions.
- PHP counts too: everything about the current critical PHP vulnerability is in the post Critical PHP security update on 21 October 2026.
Rather not keep an eye on updates yourself? With the Joomla maintenance contract we install Joomla and extension updates for you – with backups and security checks, from €30 net a month.
See the maintenance contract
