EUVD-2026-46060
GHSA-mrwj-6qcf-fqf2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable AJAX endpoint requires no authentication or user interaction; only low confidentiality impact as raw exceptions leak partial internal state.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
1DescriptionCVE.org
The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX handler responses.
AnalysisAI
Information disclosure in the Quix Page Builder Pro Joomla extension exposes raw exception data to unauthenticated remote attackers via AJAX handler responses. The affected component fails to sanitize or suppress server-side exception output before returning it to the client, potentially leaking internal application state, file paths, database structure, or configuration details depending on what triggers the exception. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network-accessible attack vector lowers the barrier for reconnaissance abuse.
Technical ContextAI
Quix Page Builder Pro is a commercial drag-and-drop page builder extension for the Joomla CMS, developed by ThemeXpert (CPE: cpe:2.3:a:themexpert.com:quix_page_builder_pro_extension_for_joomla:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a class of flaw where application error handling paths return internal exception objects or stack traces directly in HTTP responses rather than sanitized error messages. In this case, AJAX endpoints - commonly used by page builder extensions for dynamic content operations such as template loading or widget data retrieval - reflect raw PHP exception output. Depending on the exception type and message, this can expose server-side paths, class names, database table schemas, or environment configuration details useful for targeted follow-on attacks.
RemediationAI
No vendor-released patch identified at time of analysis - the sole reference points to the general product page (https://www.themexpert.com/quix-pagebuilder) rather than a security advisory. Site administrators should monitor the ThemeXpert vendor page for a patched release and apply it promptly once available. As a compensating control, configure the Joomla server's PHP environment to suppress exception output in production by setting display_errors = Off and display_startup_errors = Off in php.ini; this reduces but may not fully eliminate exception leakage depending on the extension's own error handling. Additionally, consider restricting access to AJAX handler endpoints via web server rules (e.g., Apache mod_rewrite or nginx location blocks) to authenticated sessions or known IP ranges where operationally feasible, accepting the trade-off of reduced functionality for unauthenticated page builder previews. Enabling a web application firewall rule to detect and suppress verbose PHP error patterns in HTTP responses is a further layer of defense.
Authenticated PHP code execution in ThemeXpert's Quix Page Builder Pro extension for Joomla lets a privileged builder us
Arbitrary file disclosure in ThemeXpert's Quix Page Builder Pro extension for Joomla allows unauthenticated frontend use
Improper access control in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets authenticated users uploa
SQL injection in the Quix Page Builder Pro extension for Joomla lets remote unauthenticated attackers inject arbitrary S
Stored cross-site scripting in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets an authenticated buil
Stored cross-site scripting in Quix Page Builder Pro, a Joomla CMS extension by ThemeXpert, allows authenticated builder
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today