miniOrange Joomla CVE-2026-78074

The only prerequisite for exploitation is that the target Joomla site has at least one free miniOrange extension installed and enabled. Premium miniOrange plugin users are explicitly exempt. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms no authentication, no user interaction, no elevated complexity, and no special attack requirements. There is no non-default configuration that must be present - any standard deployment of a free miniOrange Joomla extension is vulnerable. The primary limiting factors are: (1) the attacker must be able to reach the Joomla site over the network; (2) the target must be running a free (not premium) miniOrange extension; and (3) the attacker must know or discover the specific endpoint or action token used to trigger deinstallation, which requires enumeration but is not a significant barrier given Joomla's predictable URL structures.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) places this firmly in the critical-to-high tier with no attack requirements whatsoever. An attacker does not need credentials, does not need to trick a user, and faces no special network conditions. The integrity and availability impacts are both rated high because removing extensions can silently disable authentication controls, break SSO flows, or destabilize site functionality. The scope is constrained: only free miniOrange extensions are affected, and confidentiality impact is none, since the attack primitive is deletion rather than data exfiltration. EPSS data was not provided, so exploitation probability cannot be quantified precisely; however, the extremely low attack complexity means that even a non-specialist adversary could craft a working exploit quickly once the vulnerable endpoint is identified. No CISA KEV listing exists at time of analysis. The most dangerous exploitation scenario involves removing a security extension - for example, deleting JoomShield or a 2FA plugin - as a precursor to a broader site compromise, meaning the true cascading risk exceeds what the CVSS base metrics alone convey.

An unauthenticated attacker sends a crafted HTTP POST or GET request directly to the vulnerable miniOrange extension action handler on a publicly accessible Joomla site. Because the endpoint lacks any authentication check, the server processes the request and removes the targeted extension - for example, deleting the JoomShield security plugin. With the security layer now gone, the attacker may follow up with further attacks against a less-hardened Joomla instance. No public exploit code has been identified at time of analysis, but the simplicity of the attack (no authentication, no prerequisites) means proof-of-concept development is low effort.