The vulnerability is a Cross‑Site Request Forgery flaw located in the AJAX endpoint handlers of the RO CSVI extension for Joomla (versions below 9.11.0). An attacker who successfully exploits this flaw can trick an authenticated Joomla user into sending malicious AJAX requests, potentially allowing the attacker to perform privileged actions within the extension without the user's knowledge. The weakness is identified as CWE‑352, indicating a lack of anti‑CSRF mechanisms.

The affected product is the RO CSVI extension distributed by rolandd.com for the Joomla content management system. All installations running any version below 9.11.0 are impacted; versions 9.11.0 and newer have removed the vulnerable endpoint handlers. It is unclear whether older Joomla core versions host the extension; however, any environment that has installed the extension before the patch is at risk.

The CVSS score is 8.8, signifying high severity. The EPSS score is less than 1%, indicating a low probability of exploitation in the near term, and there is no listing in the CISA KEV catalog. Attackers would need the victim to be authenticated to Joomla and then trigger a crafted request, so the vector is likely web‑based and requires the victim to be logged in. The lack of anti‑CSRF tokens is the root cause.