The vulnerability lies in the SP LMS (com_splms) extension for Joomla, which before version 4.1.4 deserializes cookie data supplied by a user without any validation. This flaw follows the CWE-502 pattern of deserialization vulnerabilities. As a result, an unauthenticated attacker can inject a crafted PHP object into the cookie, causing the server to execute arbitrary code with the privileges of the web process. The impact is severe, allowing a remote attacker to compromise the entire site, exfiltrate data, or deploy further malware.

JoomShaper’s SP LMS extension for Joomla is affected. All deployments running any version earlier than 4.1.4 are vulnerable. The extension is hosted by joomshaper.net and packaged under the product name SP LMS extension for Joomla.

The CVSS score of 9.5 indicates critical severity. An EPSS score of 3% indicates exploitation probability, and combined with the flaw’s unauthenticated nature suggests a high potential for exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can simply craft a malicious cookie, which the vulnerable server will unserialize and execute, creating a straightforward attack path with no prerequisite setup.