Which versions of JoomCCK are affected by CVE-2026-49048?

JoomCCK extension versions 1.0-6.4.0 for Joomla contain a critical SQL injection vulnerability allowing unauthenticated remote attackers to extract arbitrary database contents.

How to fix or mitigate CVE-2026-49048?

Within 24 hours: Identify and catalog all Joomla instances running JoomCCK versions 1.0-6.4.0. Within 7 days: Disable or uninstall the extension if business-critical functions permit; if retention is required, implement WAF rules blocking SQL injection patterns targeting the front-end controller task parameter. Within 30 days: Monitor JoomCCK project releases for vendor patches; deploy immediately upon availability. Enable database query logging and access controls to detect exploitation attempts.

JoomCCK CVE-2026-49048

Q: What is the CVSS score of CVE-2026-49048?

CVE-2026-49048 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40003 HIGH

SQL Injection (CWE-89)

2026-06-28 Joomla

GHSA-488g-5q94-889g

SQLi Joomcck Extension For Joomla

8.7

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable front-end SQLi (AV:N/AC:L/PR:N/UI:N); confidentiality-only data disclosure (C:H, I:N, A:N) with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:23 vuln.today

Severity Changed

Jun 29, 2026 - 15:22 NVD

CRITICAL HIGH

CVSS changed

Jun 29, 2026 - 15:22 NVD

9.8 (CRITICAL) 8.7 (HIGH)

CVE Published

Jun 28, 2026 - 18:37 cve.org

HIGH 8.7

CVE Published

Jun 28, 2026 - 18:37 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.

AnalysisAI

SQL injection in the JoomCCK content-construction-kit extension for Joomla (versions 1.0 through 6.4.0) lets remote attackers read arbitrary database contents by injecting into a front-end controller task that concatenates an unescaped request parameter into two SQL statements. The flaw is reachable over the network without authentication or user interaction, and SSVC rates it automatable with total technical impact; however, there is no public exploit identified at time of analysis and EPSS is low at 0.28% (20th percentile).

Technical ContextAI

JoomCCK (JoomCoder Content Construction Kit) is a Joomla CMS extension used to build custom content types, listings, and structured articles on Joomla-powered websites, identified by CPE cpe:2.3:a:joomcoder.com:joomcck_extension_for_joomla. The root cause is CWE-89 (improper neutralization of special elements in an SQL command): a front-end controller exposes a task that takes a user-supplied request parameter and concatenates it directly into two query strings without escaping or parameterised/prepared statements. Because the entry point is a front-end controller task, it is reachable by any visitor through the public Joomla index.php component dispatch rather than requiring an administrator session.

RemediationAI

No vendor-released patch version is identified at time of analysis - the references list only the vendor site (https://www.joomcoder.com/) and advisory trackers (https://nvd.nist.gov/vuln/detail/CVE-2026-49048, https://vuldb.com/vuln/374583), with no fixed release number disclosed; check https://www.joomcoder.com/ for an update beyond 6.4.0 and upgrade to the first patched build once published. As compensating controls until a patch is confirmed: deploy a WAF or Joomla security plugin with SQL-injection signatures in front of the site (trade-off: signature evasion is possible and may produce false positives on legitimate query parameters); restrict or block public access to the specific JoomCCK front-end controller task at the web-server or .htaccess level (trade-off: breaks the affected front-end feature for legitimate visitors); enforce least-privilege on the Joomla database account so a successful injection cannot read tables beyond what the extension needs (trade-off: limited mitigation for a confidentiality bug since the extension's own data and the Joomla user/session tables remain in scope); and enable database query logging to detect anomalous read patterns. Avoid exposing the site administration interface publicly as general hardening.