YOOtheme Zoo EUVD-2026-62430

Exploitation requires only that the target Joomla site has the YOOtheme Zoo extension (version < 4.1.64) installed and that the vulnerable item element endpoint handling filter_type / type_filter is reachable - the default deployment for any Zoo-powered content view. No authentication, no privileges, and no user interaction are needed (PR:N/UI:N), matching an unauthenticated network-facing injection. The concrete prerequisite is a request reaching ItemController::element() with an attacker-controlled filter_type value or type_filter array. Limiting factors are minimal: exploitation is constrained only to sites actually running Zoo below 4.1.64; sites already on 4.1.64+ or not using Zoo are unaffected. Effective SQL extraction may depend on the backend (MySQL/MariaDB) supporting the attacker's chosen technique (UNION vs. blind/time-based).

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes remote, low-complexity, unauthenticated exploitation with high confidentiality and integrity impact - consistent with the description of an unauthenticated SQL injection reachable via ordinary HTTP request parameters. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so exploitation probability cannot be quantified from the data; however, SQL injection with these conditions is historically among the first classes to be automated once details are public. Given that any organization running Zoo - from a large hosting provider down to a small municipal or mid-sized IT team operating a single Joomla site - is reachable without credentials, remediation should be treated as urgent even absent confirmed in-the-wild activity. The primary residual uncertainty is exploit maturity, not exploitability.

An attacker sends a crafted HTTP request to a Joomla site running Zoo, setting the filter_type (or type_filter[]) parameter to a payload that breaks out of the a.type = "..." string and appends a UNION-based or boolean/time-based subquery. With no authentication or user interaction required, the response (or timing) leaks database contents such as Joomla user tables and session data, and the attacker automates extraction across all reachable sites. No public exploit is identified at time of analysis, but the injection is trivial to reproduce from the description.