CVE-2026-102781: CWE-284 Improper Access Control in ordasoft.com Touch Slider extension for Joomla

The OrdaSoft Touch Slider extension for Joomla versions 1.0.0 to 5.4.5 contains an improper access control vulnerability (CWE-284) in the modOsTouchSliderHelper::getAjax() function. This function is the sole handler for all data management operations exposed by the module and is accessible through Joomla's core com_ajax dispatcher. It does not perform any user authentication, authorization, or CSRF token validation. As a result, unauthenticated attackers can delete slider images by guessing sequential IDs via GET requests or upload a ZIP file that renames and replaces the entire #__os_touch_slider and #__os_touch_slider_text database tables with attacker-controlled content, without needing to specify a task parameter.

An unauthenticated attacker can delete any slider image by guessing its ID, causing denial of service or content disruption. More severely, the attacker can replace entire database tables related to the slider with malicious content, potentially compromising site integrity and availability. This can lead to site defacement, data loss, or further exploitation depending on the attacker's payload. No privileges or user interaction are required to exploit these flaws.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the com_ajax endpoint if possible or disable the OrdaSoft Touch Slider extension. Monitor for updates from ordasoft.com and Joomla regarding official patches or mitigations. Avoid exposing the vulnerable module to unauthenticated users.