lomart.fr UP Plugin CVE-2026-97160

Exploitation requires an authenticated, high-privilege Joomla administrator account (CVSS PR:H) on a site that has the lomart.fr UP plugin installed and enabled, in a vulnerable version (5.0.0-5.2.0 or 6.0.0-6.0.29). No user interaction is needed (UI:N) and it is remotely reachable over the network (AV:N/AC:L). The primary limiting factors are the high-privilege authentication gate - an attacker must already hold administrative access - and the narrow deployment of this specific third-party extension; no fixed version is published, so mitigation currently means restricting admin access or removing the plugin.

This is a genuinely severe code-injection flaw (CWE-94) but a low real-world priority once all signals are weighed together. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, 9.4) correctly captures the technical impact - PHP command injection that escapes the application scope to the underlying OS - but the PR:H metric is the decisive limiter: exploitation requires an already-authenticated, high-privilege Joomla administrator account. There is NO EPSS score provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The single reference (up.lomart.fr, the vendor's product page) is not even a dedicated advisory and states no fixed version, so remediation guidance is incomplete. The high CVSS is driven by impact and scope, not by ease of access - a privileged attacker who can already inject PHP typically has broad control anyway, which further deflates the marginal risk. Net: high-CVSS but low practical urgency for most defenders, dominated by the niche product footprint and the high-privilege precondition.

An attacker who has obtained (or been granted) high-privilege administrative access to a Joomla site running the lomart.fr UP plugin submits crafted input to a plugin function that passes it into a PHP execution/command sink, injecting attacker-controlled PHP or OS commands that run with the web server's privileges. Because the flaw yields code execution that crosses into the OS (scope change), the result is full server compromise. No public exploit code is referenced, so this would require the attacker to develop the payload against the specific vulnerable function.