JCTables EUVD-2026-89987

Requires a Joomla site with the JCTables extension (joomcode.com) at version <=1.21.1 installed and its front-end CRUD API controller reachable. No special configuration, authentication, or Joomla token is needed - the controller performs no token validation and no auth check on any task, so a default install is exploitable by any remote unauthenticated attacker. The only limiting factor is deployment scope: exploitation is confined to sites that actually run this specific third-party extension; there is no user-interaction, privilege, or non-default-mode barrier.

This is a genuine top-tier priority, not a high-CVSS-but-low-risk case. The vendor CVSS 4.0 vector (10.0) is fully consistent with the description: AV:N/AC:L/AT:N/PR:N/UI:N means remote, low-complexity, unauthenticated exploitation with no user interaction, and VC:H/VI:H/VA:H/SC:H/SI:H/SA:H reflects total compromise of both the vulnerable component and adjacent systems (the SC/SI/SA:H scope change aligns with the SQL-read/write-to-RCE chain described in the VulnCheck reference). Two additional 4.0 signals sharpen the picture: AU:Y (Automatable=Yes) indicates the attack can be scripted/mass-scanned, and E:A (Exploit Maturity=Attacked) is a vendor assertion that exploitation activity has been observed. Note the conflict in supplied signals: the E:A metric asserts active attack, yet no CISA KEV entry and no explicit POC=YES/KEV=YES flag were provided in this input, so per strict evidence rules this is classified as no confirmed public exploit even though the vendor vector implies real-world attack pressure - verify KEV/exploit status directly with VulnCheck. No EPSS score was supplied. The only meaningful risk-reducing factor is prevalence: JCTables is a niche third-party Joomla extension, so the absolute number of exposed instances is limited compared with a core-platform flaw. Any site actually running JCTables <=1.21.1 should treat this as an emergency.

An attacker scans for Joomla sites running the JCTables extension and sends an unauthenticated HTTP request to its front-end CRUD API controller, supplying attacker-chosen table names, column names, and values that are concatenated directly into SQL queries. Because no Joomla token or authentication check is enforced, the attacker reads arbitrary data (admin credentials, session data) and writes to the database, then leverages the read/write primitive toward remote code execution as detailed in the VulnCheck writeup. The VulnCheck reference documents the SQL-RW-to-RCE technique, indicating exploitation methodology is publicly described.