CVE-2026-21630 MEDIUM

CVE-2026-21630: Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-89 · SQLi
Published April 1, 2026
Last update April 1, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

Explanation of Vulnerability in Simple Terms

02Summary

Joomla! CMS versions 4.0.0 through 5.4.3 contain a SQL injection vulnerability in a core component. An attacker with high-level administrative privileges can inject malicious SQL commands through an unvalidated input field. This allows reading or modifying database contents without additional authentication.

What an attacker can do

03Attacker Capabilities

Read or modify database contents by injecting SQL commands through an admin-level input field.

Potential impact on your site

04Site Impact

A compromised admin account can be used to extract sensitive data, modify site content, or corrupt the database.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative access to the Joomla! backend.

Key dates

06Disclosure timeline

April 1, 2026 CVE published
April 1, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-48886 WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability CVE-2026-56068 WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerability CVE-2026-48964 WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability CVE-2026-52693 WordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerability CVE-2026-39511 WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability