CVE-2026-58078 Details
Description
Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an unauthenticated SQL injection.
A vulnerability allowing unauthenticated SQL injection has been identified in the Quix Page Builder Pro extension for Joomla. This issue is present in version 6.2.0 and all prior releases. The vulnerability arises from a front-end AJAX endpoint that processes article IDs from anonymous requests. The endpoint fails to properly sanitize the IDs before using them in database queries, allowing an anonymous visitor to manipulate the input and extract data from any database table. This includes sensitive information such as user accounts, password hashes, and other Joomla API secrets. The vulnerability has been confirmed to allow complete database read access through error-based SQL injection, where the database error messages are reflected back to the attacker, facilitating data extraction.
Users are advised to update Quix Page Builder to version 6.2.1, which fixes the SQL injection vulnerability by properly sanitizing the article ID before it is used in database queries. After updating, it is recommended to clear Joomla's cache and any CDN or page cache to ensure that stale front-end assets do not linger.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://mysites.guru/blog/quix-sql-injection-disclosure/ | [email protected] | AdvisoryBundleRemedy |
| https://www.themexpert.com/quix-pagebuilder | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ThemeXpert Quix Page Builder | <= 6.2.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | [email protected] |
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |