CVE-2026-102782: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ordasoft.com OrdaSoft Simple Membership extension for Joomla

The OrdaSoft Simple Membership extension for Joomla contains an unauthenticated SQL injection vulnerability in versions 1.0.0 through 7.4.0. The vulnerability is located in the site/simplemembership.php file, where the task=checkLoginPass is handled without authentication or access control. The handler reads a login parameter through Joomla's generic input filter, which only strips HTML/script tags but does not sanitize quotes or SQL syntax. This input is concatenated directly into an SQL query string without escaping or parameterization, leading to improper neutralization of special elements used in SQL commands (CWE-89).

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks against the affected Joomla site. This can lead to high-impact consequences including unauthorized data access, data modification, or other database manipulation. The CVSS 4.0 score is 9.3 (critical), reflecting the vulnerability's ease of exploitation (network attack vector, no privileges or user interaction required) and high impact on confidentiality, integrity, and availability.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint if possible and monitor for suspicious activity related to SQL injection attempts. Avoid using affected versions and consider upgrading once a vendor fix is released.