What is the CVSS score of CVE-2026-62415?

CVE-2026-62415 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Membership Pro are affected by CVE-2026-62415?

Membership Pro for Joomla (versions 1.0-4.6.1) contains a critical unauthenticated media upload vulnerability enabling remote attackers to upload arbitrary files without authentication.

How to fix or mitigate CVE-2026-62415?

Within 24 hours, audit your Joomla installations to identify where Membership Pro is deployed and confirm current version. Within 7 days, upgrade all affected instances to version 4.6.2, which contains the vendor patch for this vulnerability. Within 30 days, verify patching across all systems and review server logs for any suspicious media uploads prior to the patch date.

Membership Pro CVE-2026-62415

EUVD-2026-46170 CRITICAL

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-07-21 security@joomla.org

GHSA-3g5h-6x8p-7rpr

Information Disclosure

9.1

CVSS 3.1 · Vendor: joomla

Severity by source

Vendor (joomla) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.2 HIGH

Remote unauthenticated no-interaction upload gives high integrity impact (attacker writes files); confidentiality only low since uploaded media may be exposed, and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (joomla).

CVSS VectorVendor: joomla

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:27 vuln.today

CVE Published

Jul 21, 2026 - 10:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 21, 2026 - 10:16 cve.org

CRITICAL 9.1

DescriptionCVE.org

The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.

AnalysisAI

Unauthenticated media upload in the Membership Pro subscription extension for Joomla (all versions 1.0 through 4.6.1) lets remote attackers push arbitrary media assets to the server without any account or login, due to an insecure default configuration. The flaw carries a CVSS 9.1 rating and CISA's SSVC framework marks it as automatable with total technical impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It is fixed in version 4.6.2.

Technical ContextAI

Membership Pro (by Joomla Donation / joomdonation.com) is a commercial membership and subscription-management extension for the Joomla CMS, used to sell plans, collect payments, and manage subscriber content. The root cause maps to CWE-1188 (Insecure Default Initialization of a Resource): the upload endpoint that handles media assets ships with a default permission setting that treats unauthenticated visitors as allowed uploaders, rather than requiring an authenticated, authorized session. Because the exposure is a shipped default rather than a memory-safety or injection bug, every stock installation is affected until an administrator patches, and no special crafting of payloads is needed beyond exercising the extension's own upload feature.

RemediationAI

Upgrade to Membership Pro 4.6.2 or later, which is the vendor-released patched version resolving the insecure default (obtain it from the vendor at https://joomdonation.com/joomla-extensions/membership-pro-joomla-membership-subscription.html; see also the advisory at https://vuldb.com/vuln/380834). If you cannot patch immediately, the most direct compensating control is to review the extension's upload/permission settings and explicitly disable unauthenticated media uploads or restrict the upload capability to authenticated, authorized user groups - noting this may break any legitimate front-end submission workflow that relied on the permissive default. As additional interim measures, block or WAF-filter POST requests to the Membership Pro media-upload endpoint from anonymous sessions and enforce strict server-side allowlisting of uploaded file types and an upload directory with execution disabled, accepting that overly broad blocking could disrupt subscriber uploads. Remove or unpublish the extension entirely if it is not in active use.