The extension allows an attacker to upload a file that passes a MIME type check but contains PHP code, because the extension filter is commented out and the file name is used without validation. The file is written directly under the Joomla web root, where PHP will execute it, allowing arbitrary code execution. The weakness is a type of unrestricted file upload, classified as CWE-434. This flaw yields full remote code execution control to any user who can access the front‑end upload functionality, and there is no prerequisite authentication or ACL enforcement. The impact therefore includes complete compromise of the affected site and potentially the underlying web server.

OrdaSoft Joomla CCK versions prior to 8.3.16 are vulnerable. The vulnerability exists only in the Joomla extension component provided by ordasoft.com, which is deployed as part of the Joomla content construction kit.

The CVSS base score is 10.0, indicating the highest severity. No EPSS score is available, so the current exploitation probability is unknown, but the absence of any authentication barriers means the vulnerability can be exploited from the public internet. The vulnerability is not listed in the CISA KEV catalog at this time, but the remote code execution capability makes it a high‑priority risk for any site running the affected extension. Attackers could use the public front‑end task="getContent" route to upload a PHP polyglot file mapping to a valid MIME type and trigger execution via the web server. Due to the lack of further restrictions, exploitation is straightforward for anyone who can reach the target.