The vulnerability is an unauthenticated SQL injection that arises when the order column in the OrdaSoft Joomla CCK extension accepts user supplied data without proper validation. An attacker can inject malicious SQL statements into this field, potentially extracting sensitive data from the database, altering content, or affecting site functionality, and in extreme cases facilitating further compromise of the Joomla environment.

The OrdaSoft Joomla Content Construction Kit, distributed by ordasoft.com, is impacted for all releases older than 8.3.16. The vulnerability exists whenever the order field is not properly sanitized, making any version below 8.3.16 susceptible.

With a CVSS score of 9.3 the flaw is considered critical. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying no publicly reported exploitation yet. The attack vector is remote and unauthenticated: any visitor to the Joomla site can supply crafted input to an order field, triggering the injection without needing credentials.