This vulnerability is an unauthenticated SQL injection that occurs when the Joomla extension reads a login request parameter without sanitization or use of prepared statements. Because the input is concatenated directly into an SQL query, an attacker can inject arbitrary SQL, potentially reading, modifying, or deleting data, and in some contexts the injection could compromise the database.

An extension from ordasoft.com called OrdaSoft Simple Membership for Joomla is affected, specifically any installation running a version earlier than 7.4.0.

The CVSS score of 9.3 indicates a high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack/simplemembership.php with the task parameters set to checkLoginPass, where the attacker supplies a malicious login value. Because no authentication or access control is enforced, any visitor can trigger the injection.