StageIt Joomla Extension CVE-2026-105600

Exploitation requires an authenticated session with high privileges in the Joomla administration back end (CVSS PR:H) - the attacker must be able to reach and modify the StageIt extension's configuration 'setting string' values, which is where attacker-controlled input is interpreted as code. The affected builds are StageIt 1.0 through 5.7.5 and 6.0 through 6.3.5; sites outside these ranges are not in scope. The dominant limiting factor is the administrative privilege requirement: this is not remotely exploitable by an unauthenticated user, and no user interaction by a victim is needed (UI:N) once the attacker has the required access. The precise feature path and how the setting string is evaluated are not described in the available sources.

This is a code-injection (CWE-94) flaw in the StageIt Joomla extension by php-web-design.com, rated CVSS 8.6 under the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N with full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) and no scope change to other systems (SC:N/SI:N/SA:N). The signals are mixed and should be read carefully. The network vector and low attack complexity argue for easy remote reach, but PR:H is decisive: exploitation requires high-privilege (administrative) access to the Joomla back end, which sharply narrows the realistic attacker population to authenticated operators or anyone who has already compromised an admin session. No EPSS score was provided, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference was supplied - the only reference is the vendor's own version-6 changelog. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a high-impact-but-privilege-gated issue rather than an unauthenticated internet-facing emergency. Net assessment: genuinely serious for anyone running StageIt because post-authentication RCE lets a back-end user fully take over the hosting Joomla site, but it is not a drive-by, mass-exploitable issue - the PR:H gate is the dominant limiting factor and should temper urgency relative to the raw 8.6 score. The description does not explain how the 'setting strings' are processed into executed code, so the precise trigger mechanism is not described in the available sources.

An attacker who already holds a privileged StageIt/Joomla administrative account (or has hijacked such a session) submits a crafted value into one of the extension's setting string fields; because the input is interpreted as PHP/code (CWE-94), the server executes attacker-controlled code. No public exploit code was identified at time of analysis, and the exact injection point is not detailed in the available sources.