CVE-2026-77994 Overview
CVE-2026-77994 is a second-order SQL injection vulnerability in Page Builder CK, a Joomla extension developed by joomlack.fr. The flaw affects versions prior to 3.6.5 and resides in the loadStyles method of the frontend page model. An unauthenticated remote attacker can inject SQL statements that execute when the vulnerable method later processes stored input. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Unauthenticated attackers can read, modify, or destroy database contents on Joomla sites running Page Builder CK before 3.6.5, exposing user records, credentials, and site configuration.
Affected Products
- Joomla Extension: Page Builder CK by joomlack.fr
- All versions prior to 3.6.5
- Joomla sites with the vulnerable frontend page model deployed
Discovery Timeline
- 2026-08-24 - CVE-2026-77994 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-77994
Vulnerability Analysis
The vulnerability is a second-order (stored) SQL injection. Unlike first-order injection, the malicious payload is not executed when it first enters the application. Instead, attacker-controlled data is stored and later concatenated into a SQL query when the loadStyles method of the frontend page model runs.
Because the payload activates during a later database operation, input filters applied at the initial write path fail to prevent execution. The attack path requires no authentication and no user interaction, and it targets the extension over the network through standard HTTP requests to a Joomla site.
Successful exploitation grants read and write access to the underlying database, which on a typical Joomla deployment includes user accounts, session data, hashed credentials, and site configuration. Attackers can pivot to full site compromise by extracting super-user credentials or writing malicious data that alters application behavior.
Root Cause
The root cause is missing parameterization and inadequate neutralization of SQL metacharacters in the loadStyles method. Data previously stored through the extension is concatenated directly into a SQL statement without prepared statements or context-aware escaping, violating the mitigations described in CWE-89.
Attack Vector
The attack vector is network-based and does not require privileges or user interaction. An attacker submits crafted input through a Page Builder CK feature that persists data. When a subsequent request causes the frontend page model to call loadStyles, the stored payload is embedded in a SQL query and executed against the Joomla database. See the JoomlaCK vendor site for extension details.
No public proof-of-concept exploit is currently referenced in the CVE record.
Detection Methods for CVE-2026-77994
Indicators of Compromise
- Unexpected SQL syntax fragments such as UNION SELECT, SLEEP(, --, or INFORMATION_SCHEMA in stored Page Builder CK records or database rows tied to styles and page assets.
- Anomalous outbound requests, new administrator accounts, or modified #__users rows appearing shortly after frontend page rendering activity.
- Web server logs showing repeated requests to Page Builder CK frontend endpoints followed by errors from the Joomla database driver.
Detection Strategies
- Review Joomla database logs and MySQL general or audit logs for query patterns referencing the styles table with suspicious concatenated literals.
- Deploy a web application firewall rule set that inspects POST parameters submitted to Page Builder CK endpoints for SQL injection signatures.
- Compare deployed Page Builder CK version against 3.6.5 across all Joomla instances and flag any earlier release.
Monitoring Recommendations
- Alert on Joomla error log entries containing SQL syntax or mysqli warnings originating from the loadStyles code path.
- Monitor for creation of new Joomla users with elevated group assignments outside of change windows.
- Track file integrity of Joomla template and extension directories to detect follow-on webshell placement after database compromise.
How to Mitigate CVE-2026-77994
Immediate Actions Required
- Upgrade Page Builder CK to version 3.6.5 or later on every Joomla instance where the extension is installed.
- Audit the #__users, session, and Page Builder CK data tables for injected content and unauthorized administrator accounts.
- Rotate Joomla administrator passwords, API tokens, and database credentials if exploitation cannot be ruled out.
Patch Information
The vendor fix is delivered in Page Builder CK version 3.6.5. Obtain the patched release from the joomlack.fr vendor site and validate the installed version through the Joomla extension manager after upgrade.
Workarounds
- Disable or unpublish the Page Builder CK extension until the upgrade to 3.6.5 can be applied.
- Restrict access to frontend URLs that render Page Builder CK content using IP allow-listing or authentication at the web server tier.
- Enable a web application firewall in blocking mode with SQL injection rules tuned for Joomla extension parameters.
# Verify installed Page Builder CK version and disable if vulnerable
mysql -u joomla_user -p joomla_db -e \
"SELECT name, element, manifest_cache FROM #__extensions WHERE element LIKE '%pagebuilderck%';"
# Unpublish the extension until patched (adjust extension_id as needed)
mysql -u joomla_user -p joomla_db -e \
"UPDATE #__extensions SET enabled = 0 WHERE element LIKE '%pagebuilderck%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
