The vulnerability allows an authenticated Joomla builder user to inject arbitrary PHP code into element content. Because the Quix Page Builder Pro extension includes element content via view‑cache include(), the injected PHP tags are executed on the server. This results in remote code execution, giving full control over the affected web server. The flaw is a classic code injection (CWE‑94) that can compromise confidentiality, integrity, and availability.

The issue affects the Quix Page Builder Pro extension for Joomla versions earlier than 6.2.1, as distributed by themexpert.com. Only installations that have caching enabled (the default) are vulnerable. The vulnerability does not affect the core Joomla application or other extensions.

With a CVSS score of 8.9 the vulnerability is classified as high severity. The exploit requires the attacker to authenticate as a user with builder privileges (core.create/core.edit). Once authenticated, the attacker can inject PHP tags into the page content and trigger execution through Joomla’s view‑cache mechanism. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation is reported at this time. Nevertheless, because the attack surface allows arbitrary code execution, the risk remains significant and any Joomla site using an affected version and caching should consider this a priority.