EUVD-2026-44896
GHSA-4v43-gx32-wcrj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SQLi (PR:N, AV:N, AC:L) with full DB read/write impact (C/I/A:H); UI:R mirrors the source UI:P interaction requirement.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
The Joomla extension Quix Page Builder Pro is vulnerable to an unauthenticated SQL injection.
AnalysisAI
SQL injection in the Quix Page Builder Pro extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through a crafted request, enabling database read and write against affected sites. The CVSS 4.0 base score is 8.7 (High), reflecting network vector, low complexity, no privileges, and high impact to confidentiality, integrity, and availability of the vulnerable database. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; a third-party disclosure write-up exists on mysites.guru.
Technical ContextAI
The affected component is the commercial Quix Page Builder Pro extension published by ThemeXpert (CPE cpe:2.3:a:themexpert.com:quix_page_builder_pro_extension_for_joomla) running on the Joomla CMS. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaches a database query without adequate parameterization or escaping. In Joomla extensions this class of flaw typically arises when request parameters are concatenated into JDatabaseQuery/raw SQL statements in a controller or model that is reachable via the site's front-end request routing, allowing an attacker to alter query logic.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version number was provided in the input, so administrators should treat the current release as vulnerable and monitor the vendor page at https://www.themexpert.com/quix-pagebuilder for a patched Quix Page Builder Pro release, then upgrade as soon as one is published; the disclosure at https://mysites.guru/blog/quix-sql-injection-disclosure/ may contain additional detail on affected versions. As compensating controls until a patch is available, deploy a Web Application Firewall (e.g. Joomla-aware WAF rules) to block SQL-injection patterns on requests routed to the Quix extension, restrict or IP-allowlist access to Quix front-end endpoints where feasible, ensure the database account used by Joomla has least-privilege rights (no unnecessary FILE/DROP privileges) to limit blast radius, and increase database and web logging to detect anomalous queries - noting that WAF rules can be bypassed and may cause false positives on legitimate builder traffic, and endpoint restrictions may break front-end rendering that relies on Quix.
Authenticated PHP code execution in ThemeXpert's Quix Page Builder Pro extension for Joomla lets a privileged builder us
Arbitrary file disclosure in ThemeXpert's Quix Page Builder Pro extension for Joomla allows unauthenticated frontend use
Improper access control in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets authenticated users uploa
Stored cross-site scripting in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets an authenticated buil
Information disclosure in the Quix Page Builder Pro Joomla extension exposes raw exception data to unauthenticated remot
Stored cross-site scripting in Quix Page Builder Pro, a Joomla CMS extension by ThemeXpert, allows authenticated builder
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today