UP Joomla Plugin CVE-2026-97162

Requires the target Joomla site to have the lomart.fr UP plugin installed at version 5.0.0-5.2.0 or 6.0.0-6.0.29 and to expose the vulnerable request handler(s). Given PR:N/UI:N no authentication or victim interaction is needed, but the AT:P attack-requirement flag indicates the injectable feature/endpoint must be reachable in the deployment. Exploitation is limited by the plugin's low install base - sites without this specific extension are unaffected regardless of Joomla core version.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, score 8.3) describes an unauthenticated, network-reachable, low-complexity SQL injection with no user interaction - the classic profile of a directly exploitable web flaw. However, the vector marks VC:N while VI:H/VA:H, which is unusual for CWE-89: SQL injection almost always yields data-read (confidentiality) impact, so the vendor scoring appears to understate confidentiality. The AT:P (attack requirements present) flag signals that some non-default condition applies - most plausibly that the affected UP plugin must be installed and its vulnerable feature reachable, not that the base Joomla install is exploitable. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation. Net: a genuinely dangerous vulnerability class (unauth SQLi) but in a niche third-party Joomla extension with limited deployment, and no confirmed exploitation signal - treat as important-to-patch where the plugin is installed rather than an emergency across the fleet.

An unauthenticated attacker sends a crafted HTTP request to a Joomla site running a vulnerable version of the lomart.fr UP plugin, injecting SQL through one of several unsanitized parameters. This lets them manipulate database queries to read, alter, or destroy stored data. No public exploit code was identified at time of analysis.