CVE-2026-57831 describes an unauthenticated blind SQL injection vulnerability in the DP Calendar extension for Joomla, affecting versions from 8.18.0 up to and including 10.11.1. The vulnerability arises from improper neutralization of special elements used in SQL commands (CWE-89), allowing attackers to execute arbitrary SQL queries without authentication. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality. No known exploits in the wild have been reported, and no vendor advisory or patch is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to perform blind SQL injection attacks against the DP Calendar extension's backend database. This may lead to unauthorized data disclosure or manipulation, impacting the confidentiality and integrity of the affected system's data. The vulnerability does not require any privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the DP Calendar extension to mitigate risk. Monitor official digital-peak.com and Joomla advisories for updates.