This vulnerability allows attackers to inject malicious SQL into the plname parameter of the NextGen Editor component. An unauthenticated user can send a crafted GET request to the component’s configuration view, leading to arbitrary SQL execution. The impact is full compromise of the database, enabling data exfiltration, modification, or deletion, and thus compromising confidentiality, integrity, and availability. The weakness is a classic SQL injection flaw, identified as CWE-89.

The affected system is the NextGen Editor extension version 2.1.0 for Joomla. The component can be found at extensions.joomla.org and is commonly used in Joomla installations.

The CVSS score of 8.8 indicates a high severity. No EPSS score is available, so the current exploitation probability is unknown, but the vulnerability can be exploited without authentication by simply sending a GET request, which implies a low entry barrier. The issue is not listed in CISA’s KEV catalog, suggesting that no publicly known exploit has been catalogued yet. Nevertheless, attackers can easily construct the GET payload and achieve full database compromise. The likely attack vector is an unauthenticated HTTP request to the component’s configuration endpoint.