Which versions of Quix Page Builder Pro are affected by EUVD-2026-46058?

Quix Page Builder Pro for Joomla contains an authenticated remote code execution vulnerability (CVSS 8.9) exploitable by users with builder permissions.

How to fix or mitigate EUVD-2026-46058?

Within 24 hours: conduct an immediate audit of all Joomla accounts holding core.create or core.edit permissions. Within 7 days: implement compensating controls by either disabling the Quix Page Builder Pro extension, restricting these permissions to a minimal set of trusted administrators, or disabling Joomla template caching. Within 30 days: continuously monitor ThemeXpert and Joomla security channels; apply any vendor-released patch within 24 hours of its availability.

Quix Page Builder Pro EUVD-2026-46058

Q: What is the CVSS score of EUVD-2026-46058?

EUVD-2026-46058 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-60026 HIGH

Code Injection (CWE-94)

2026-07-20 Joomla

GHSA-pcwx-c962-fh8r

PHP RCE Code Injection Quix Page Builder Pro Extension For Joomla Themexpert Com

8.9

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable builder function with low complexity but requiring a high-privilege content role (PR:H); RCE breaks out of the app into the OS/web-server context (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 19:24 vuln.today

CVE Published

Jul 20, 2026 - 18:11 cve.org

HIGH 8.9

DescriptionCVE.org

The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user (core.create/core.edit) could inject PHP tags in element content, that got executed via view-cache include(). Requires caching on (default).

AnalysisAI

Authenticated PHP code execution in ThemeXpert's Quix Page Builder Pro extension for Joomla lets a privileged builder user (holding core.create or core.edit permissions) embed raw PHP tags in element content that are subsequently executed when the server's view-cache layer include()s the cached template. Exploitation requires caching to be enabled, which is the default, and yields full remote code execution on the underlying web server. No public exploit identified at time of analysis, though the reporter is Joomla itself and the CVSS 4.0 base score is 8.9 (High).

Technical ContextAI

Quix Page Builder Pro is a commercial drag-and-drop page builder distributed as a Joomla extension (CPE cpe:2.3:a:themexpert.com:quix_page_builder_pro_extension_for_joomla). The root cause is CWE-94 (Improper Control of Generation of Code, i.e. code injection): user-supplied element content is written into a server-side view cache and later loaded with PHP's include() construct. Because include() compiles and executes anything between PHP tags in the included file, any <?php ... ?> sequence stored in an element becomes live server-side code at render time. The vulnerability lives in the caching pipeline rather than the initial input handler, so the injected code only detonates once the cache is populated and re-read - which is why the 'caching on (default)' precondition is architecturally essential rather than incidental.

RemediationAI

No vendor-released patch version was identified at time of analysis, so an exact upgrade target cannot be cited from the input data - monitor ThemeXpert at https://www.themexpert.com/quix-pagebuilder and update to the fixed Quix Page Builder Pro release as soon as it is published. As compensating controls until a patch is applied, tighten Joomla ACLs so that only fully trusted administrators retain core.create/core.edit on Quix content (removing these permissions from lower-trust author/editor accounts directly eliminates the required privilege), and audit existing Quix elements for embedded PHP tags. Because the code executes only through the view cache, disabling Quix/Joomla view caching removes the execution path, with the trade-off of measurable performance degradation and higher server load on content-heavy pages. Additionally, restrict or monitor filesystem write access to the view-cache directory and consider a WAF or content rule that rejects '<?php' and '<?=' sequences submitted through the builder. Rotate credentials and review logs for any accounts that could already have planted a payload.