OrdaSoft Simple Membership EUVD-2026-94216

No special conditions - remote unauthenticated exploitation against default configurations of OrdaSoft Simple Membership for Joomla prior to 7.4.0, because site/simplemembership.php dispatches task=checkLoginPass with no authentication or access-control check and concatenates the login parameter into SQL unescaped. The only practical prerequisite is that the vulnerable Simple Membership component is installed and enabled on a publicly reachable Joomla site; Joomla's generic input filter strips HTML/script tags but leaves quotes and SQL syntax intact, so it does not limit exploitation. No user interaction, authentication, or non-default setting is required.

All signals converge on genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity exploitation with no authentication and no user interaction, and the description corroborates it precisely: site/simplemembership.php dispatches task=checkLoginPass with no authentication or access-control check, and the login parameter is concatenated into SQL unescaped. The VC:H/VI:H/VA:H impact aligns with a classic unauthenticated SQL injection (CWE-89) that can read and modify database contents. No EPSS score, no SSVC decision data, and no CISA KEV entry were provided, and no public exploit is identified at time of analysis, so there is no evidence of active or automated exploitation yet. However, the unauthenticated, no-UI nature of SQLi means exploit development is typically trivial once details are public, so the absence of a POC should be treated as a timing artifact rather than a reason to deprioritize. Net: a real, actionable priority for any site running the affected extension, tempered only by the apparently niche deployment footprint.

A remote attacker, without any account or credentials, sends an HTTP request to the Joomla site invoking the Simple Membership component with task=checkLoginPass and a crafted login value containing SQL syntax. Because the value passes only through Joomla's HTML/tag-stripping input filter (which does not touch quotes or SQL syntax) and is concatenated directly into a query, the attacker injects arbitrary SQL to dump user credentials or alter data. No public exploit code is identified at time of analysis, but the low-complexity, unauthenticated vector makes weaponization straightforward.