StageIt Joomla Extension CVE-2026-103420

Exploitation requires that the victim be an actively authenticated Joomla user/administrator on a site running the StageIt extension in an affected version (1.0 through 5.7.5, or 6.0 through 6.3.5), and that this victim be induced to interact with attacker-controlled content (UI:P) - e.g. visit a malicious page or click a crafted link - while their session is valid. The attacker needs no credentials of their own (PR:N) and no special target configuration is stated in the available sources; the specific state-changing actions that can be forged are described only as 'various actions' and are not individually enumerated in the input. The user-interaction requirement and the dependency on an authenticated victim session are the primary factors limiting exploitation.

This is a cross-site request forgery flaw (CWE-352) in the StageIt Joomla extension. The only severity signal provided is a CVSS 4.0 vector (7.2, AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H), which reflects a CSRF pattern precisely: network-reachable, low complexity, no attacker privileges, but requiring victim interaction (UI:P), with high integrity and availability impact and no confidentiality impact. No EPSS score, no KEV listing, and no PoC were supplied - the single reference is a vendor changelog page, not exploit code - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week', indicating moderate rather than emergency urgency, which is consistent with a CSRF bug that depends on tricking an authenticated user. Net assessment: a legitimately impactful flaw for sites running this extension (state-changing actions can be forced), but real-world risk is bounded by the user-interaction requirement and by the extension's limited deployment footprint; EPSS and exploitation data are missing, so exploitation likelihood cannot be quantified from the input.

An attacker crafts a malicious web page or email link and lures a logged-in Joomla administrator or user who has the StageIt extension active into visiting it; the page silently submits a forged request to the Joomla site, causing one of the extension's state-changing actions to execute under the victim's session. No public exploit code was provided, and success depends on the victim being authenticated and interacting with the attacker's content (UI:P).