CVE-2026-60026: Quix Page Builder RCE Vulnerability

CVE-2026-60026 Overview

CVE-2026-60026 is an authenticated PHP code execution vulnerability in the Quix Page Builder Pro extension for Joomla, developed by themexpert.com. The flaw affects Quix Page Builder versions prior to 6.2.1. Authenticated users holding core.create or core.edit permissions can inject PHP tags into element content. That content is later executed through the view-cache include() call when caching is enabled, which is the default configuration.

The vulnerability is classified under [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact
Attackers with builder-level privileges can execute arbitrary PHP on the underlying web server, resulting in full site compromise and potential lateral movement.

Affected Products

Themexpert Quix Page Builder Pro (Joomla extension) versions prior to 6.2.1
Joomla installations with Quix caching enabled (default)
Any site where builder users have core.create or core.edit permissions

Discovery Timeline

2026-07-20 - CVE-2026-60026 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60026

Vulnerability Analysis

Quix Page Builder Pro allows authenticated builder users to add and edit page elements through the Joomla administrative interface. The extension caches rendered views to disk and later loads them with PHP's include() function. Because element content is not stripped of PHP delimiters before being written to cache files, injected <?php ... ?> tags become executable code inside the cached view.

The attacker must hold core.create or core.edit privileges in the Joomla ACL, which places this in the authenticated-attacker category. Once the malicious element is saved and the cached view is regenerated, any subsequent request that triggers the cache include executes the injected payload with the privileges of the web server process.

Exploitation requires caching to be enabled. This is the default installation state, so most production deployments are exposed without additional configuration changes.

Root Cause

The root cause is unsafe handling of user-supplied element content combined with dynamic PHP file inclusion. The view-cache layer treats element content as trusted template data. It writes it verbatim into .php cache files that are subsequently loaded with include(). No sanitization strips PHP open tags, and no allow-listing restricts which content types can enter the cached template.

Attack Vector

The attack requires network access to the Joomla back end and valid credentials with builder editing rights. The attacker creates or edits a Quix page element and embeds PHP code within an accepted content field. Saving the page triggers cache generation. The next front-end request that loads the cached view invokes include() against the poisoned file, executing the attacker's PHP under the web server context.

Successful exploitation yields arbitrary command execution, file read and write on the web root, database credential theft from configuration.php, and a foothold for persistence through web shells.

No public proof-of-concept exploit code is currently available. See the Themexpert Quix PageBuilder Overview for product context.

Detection Methods for CVE-2026-60026

Indicators of Compromise

Presence of <?php or <?= strings inside Quix element records stored in the Joomla database
Unexpected .php files or modified cache entries under the Quix view-cache directory
Web server processes spawning shell interpreters (sh, bash, cmd.exe) from PHP-FPM or Apache worker contexts
Outbound network connections initiated by the web server to unfamiliar hosts shortly after page edits

Detection Strategies

Query the Joomla database for Quix element rows containing PHP tag substrings and review recent edits by builder accounts
Monitor the Quix cache directory for .php files whose contents include suspicious functions such as eval, system, exec, passthru, or base64_decode
Correlate Joomla audit logs for core.edit and core.create actions with subsequent anomalous web server behavior

Monitoring Recommendations

Enable Joomla action logging for the Quix component and forward events to a centralized log platform
Alert on new child processes spawned by the web server user (www-data, apache, nginx) following page-builder activity
Track file integrity of the Joomla web root and Quix cache directories to identify unauthorized writes

How to Mitigate CVE-2026-60026

Immediate Actions Required

Upgrade Quix Page Builder Pro to version 6.2.1 or later on all Joomla sites
Audit accounts assigned core.create and core.edit permissions and revoke privileges from users who do not require them
Inspect existing Quix elements and cache files for embedded PHP payloads before restoring normal operations
Rotate database credentials and administrative passwords if compromise is suspected

Patch Information

The vendor has addressed the issue in Quix Page Builder Pro 6.2.1. Administrators should apply the update through the Joomla Extensions Manager or download the latest release from themexpert.com. Confirm the installed version under Extensions > Manage after upgrading.

Workarounds

Disable Quix view caching until the patched version is deployed, accepting the associated performance impact
Restrict builder-level Joomla permissions to a minimal set of trusted administrators
Place the Joomla back end behind a web application firewall or IP allow-list to limit exposure of authenticated endpoints

bash

# Verify the installed Quix version and inspect cache for PHP tags
grep -R "version" /path/to/joomla/administrator/components/com_quix/quix.xml
grep -RIl --include='*.php' -E '<\?php|<\?=' /path/to/joomla/cache/com_quix/