The Fabrik extension for Joomla contains a plugin that reorders database rows. The plugin performs no access checks, allowing any visitor to trigger a reorder operation. This flaw enables an unauthenticated attacker to alter the order of records, potentially changing the way content is displayed or accessed within the site. The vulnerability can be exploited to manipulate application logic, leading to data integrity violations and possible privilege escalation if ordering affects visibility or access control. The weakness is classified as CWE‑284, improper authorization.

Vendors affected are fabrikar.com, which develops the Fabrik Joomla extension. The flaw exists in all versions prior to 4.7.2. Administrators should verify the installed extension version and apply an update to 4.7.2 or newer to eliminate the unchecked reordering capability.

With a CVSS score of 6.9, this issue presents a moderate severity risk. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalogue. Because the flaw can be exercised by unauthenticated users through the web interface, a typical attack involves sending crafted requests to the reorder endpoint. The lack of authentication checks makes exploitation straightforward, so sites running affected versions should treat it as a non‑trivial risk.