CVE-2026-74254 Overview
CVE-2026-74254 is a SQL injection vulnerability [CWE-89] in the Page Builder CK Joomla extension developed by joomlack.fr. The flaw resides in the styles model of the extension and allows unauthenticated attackers to inject arbitrary SQL statements over the network. Version 3.6.4 addressed the frontend attack vector, while version 3.6.5 closed the corresponding backend vector. All Page Builder CK releases prior to 3.6.5 are affected.
Critical Impact
Unauthenticated attackers can extract, modify, or destroy Joomla database contents through the vulnerable styles model, compromising site confidentiality, integrity, and availability.
Affected Products
- Page Builder CK for Joomla versions prior to 3.6.4 (frontend vector)
- Page Builder CK for Joomla versions prior to 3.6.5 (backend vector)
- Joomla installations using the joomlack.fr Page Builder CK extension
Discovery Timeline
- 2026-08-17 - CVE-2026-74254 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-74254
Vulnerability Analysis
The vulnerability arises in the styles model component of Page Builder CK, a page-building extension for Joomla content management systems. User-controlled input reaches SQL query construction without proper sanitization or parameterization. Attackers submit crafted requests that inject SQL syntax into database queries executed by the Joomla backend. Successful exploitation reveals arbitrary database contents, including administrator password hashes, session tokens, and configuration secrets.
The issue was fixed in two stages. Version 3.6.4 patched the frontend-facing entry point that anonymous visitors could reach. Version 3.6.5 later addressed a second instance of the same weakness in the backend administrative interface.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The styles model concatenates request parameters directly into SQL statements rather than binding them as parameters. This pattern is a well-documented anti-pattern in Joomla extension development, where developers should use the framework's JDatabaseQuery API with bound parameters.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request containing a malicious payload targeting the styles model endpoint. Because the frontend vector was reachable before the 3.6.4 patch, any internet-exposed Joomla site running a vulnerable version could be attacked without credentials. Refer to the JoomlaCK Resource Website for vendor-specific technical guidance.
Detection Methods for CVE-2026-74254
Indicators of Compromise
- Unusual HTTP requests to Page Builder CK component URLs containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA
- Web server access logs showing long, URL-encoded query strings targeting the styles model endpoint
- Unexpected database queries in Joomla logs originating from the Page Builder CK component
- New or modified Joomla #__users records, particularly Super User accounts created outside normal administrative activity
Detection Strategies
- Inspect Joomla and web server logs for repeated 200-status requests targeting Page Builder CK endpoints with anomalous parameter values
- Deploy WAF signatures that detect SQL injection patterns against Joomla component routes
- Correlate database error responses with client IP addresses to identify probing activity
Monitoring Recommendations
- Enable Joomla debug and database query logging on staging systems to establish a baseline of legitimate Page Builder CK traffic
- Forward web server, application, and database logs to a central analytics platform for correlation and retention
- Alert on outbound data transfers from Joomla database hosts that exceed normal volume thresholds
How to Mitigate CVE-2026-74254
Immediate Actions Required
- Upgrade Page Builder CK to version 3.6.5 or later, which remediates both frontend and backend SQL injection vectors
- If a full upgrade is not immediately possible, upgrade to at least 3.6.4 to close the unauthenticated frontend vector
- Audit Joomla administrator accounts for unauthorized additions and rotate all administrator and database credentials
- Review database access logs for the period preceding the patch to identify prior exploitation
Patch Information
The vendor released Page Builder CK 3.6.4 to fix the frontend SQL injection and 3.6.5 to fix the backend variant. Only version 3.6.5 fully addresses CVE-2026-74254. Download the latest release from the JoomlaCK Resource Website.
Workarounds
- Restrict access to the Joomla administrator interface using IP allowlisting at the web server or WAF layer until the extension is patched
- Temporarily disable the Page Builder CK component in Joomla Extension Manager if patching cannot be scheduled promptly
- Apply generic WAF rules that block SQL injection patterns on requests targeting the vulnerable component routes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
