The Joomla extension Quix Page Builder Pro, versions 1.0 up to 6.2.0, contains an unauthenticated SQL injection vulnerability (CWE-89). This vulnerability allows remote attackers to execute arbitrary SQL commands without requiring authentication, potentially leading to unauthorized data access or manipulation. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction required. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database of the affected Joomla extension, potentially leading to unauthorized data disclosure, data modification, or other impacts depending on the database privileges. Since the vulnerability is unauthenticated, it can be exploited remotely without credentials, increasing the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the vulnerable extension or disabling it if feasible to reduce exposure.