The vulnerability is a SQL injection flaw present in the UP plugin for Joomla provided by lomart.fr. Multiple injection vectors allow an attacker to embed arbitrary SQL statements through unsanitized input fields, potentially leading to unauthorized data disclosure or modification. This flaw corresponds to CWE‑89 and could be used to tamper with the database, exfiltrate sensitive information, or, if database privileges are high, elevate the attacker’s privileges within the application.

The affected product is the UP plugin for Joomla from lomart.fr. Versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29 are vulnerable. Sites using these plugin releases should verify the installed version and consider updating or disabling the plugin.

The CVSS score of 8.3 indicates high severity, reflecting a significant impact on confidentiality and integrity. No exploit probability (EPSS) score is currently available, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of public exploitation is unclear. The likely attack vector is via the web interface of the Joomla site: a remote attacker who can send crafted requests to the plugin’s input endpoints may exploit the injection. Defenses would include proper input validation and reducing database privileges.