Joomla Component jomres 9.11.2 contains a cross‑site request forgery flaw that lets an attacker alter the password, e‑mail address, or profile details of any authenticated user who visits a crafted HTML form. The vulnerability does not grant arbitrary code execution but permits unauthorized changes to user credentials and personal information.

Any Joomla site that installs the Jomres component version 9.11.2 is vulnerable. The flaw specifically affects this version of Jomres; later releases that remove the missing CSRF checks are not impacted.

The CVSS base score of 5.3 indicates a moderate severity. EPSS is not available, and the issue is not listed in CISA KEV, suggesting limited public exploitation data. The attack requires an authenticated user to visit a malicious page, so the likelihood is constrained by user behavior. Nonetheless, an attacker who successfully deceives a target can corrupt account data and potentially facilitate further attacks such as social‑engineering or phishing.