CVE-2026-76570 CRITICAL

CVE-2026-76570: Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

Vendor Joomcode.com
Product JCTables extension for Joomla
Weakness CWE-89 · SQLi
Published September 30, 2026
Last update September 30, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y

What the vulnerability does

01Description

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

Key dates

02Disclosure timeline

September 30, 2026 CVE published
September 30, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-66458 WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability CVE-2026-81277 WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability CVE-2026-66472 WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability CVE-2026-5097 wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter CVE-2026-66430 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability