CVE-2026-60026: CWE-94 Improper Control of Generation of Code ('Code Injection') in themexpert.com Quix Page Builder Pro extension for Joomla
An authenticated code injection vulnerability exists in themexpert.com Quix Page Builder Pro extension for Joomla versions 1.0 through 6.2.0. Authenticated users with core.create or core.edit permissions can inject PHP code into element content, which is executed via the view-cache include() mechanism when caching is enabled (default setting). This allows execution of arbitrary PHP code on the server.
AI Analysis
Technical Summary
CVE-2026-60026 is an authenticated PHP code execution vulnerability in the Quix Page Builder Pro Joomla extension by themexpert.com. Versions prior to 6.2.1 allow users with specific authenticated permissions (core.create/core.edit) to inject PHP tags into element content. When Joomla's caching is enabled, this injected code is executed through the view-cache include() function, leading to remote code execution on the server. This vulnerability is classified under CWE-94 (Improper Control of Generation of Code).
Potential Impact
Successful exploitation allows an authenticated user with builder permissions to execute arbitrary PHP code on the server, potentially leading to full system compromise, data theft, or disruption of service. The vulnerability requires authentication and caching to be enabled (which is the default).
Mitigation Recommendations
No official patch or fix is currently confirmed. Users should upgrade to version 6.2.1 or later once available, as the vulnerability affects versions up to 6.2.0. Until a fix is applied, consider restricting builder user permissions to trusted users only and disabling caching if feasible. Monitor the vendor advisory for updates on remediation.
CVE-2026-60026: CWE-94 Improper Control of Generation of Code ('Code Injection') in themexpert.com Quix Page Builder Pro extension for Joomla
Description
An authenticated code injection vulnerability exists in themexpert.com Quix Page Builder Pro extension for Joomla versions 1.0 through 6.2.0. Authenticated users with core.create or core.edit permissions can inject PHP code into element content, which is executed via the view-cache include() mechanism when caching is enabled (default setting). This allows execution of arbitrary PHP code on the server.
CVSS v4.0
Score 8.9high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-60026 is an authenticated PHP code execution vulnerability in the Quix Page Builder Pro Joomla extension by themexpert.com. Versions prior to 6.2.1 allow users with specific authenticated permissions (core.create/core.edit) to inject PHP tags into element content. When Joomla's caching is enabled, this injected code is executed through the view-cache include() function, leading to remote code execution on the server. This vulnerability is classified under CWE-94 (Improper Control of Generation of Code).
Potential Impact
Successful exploitation allows an authenticated user with builder permissions to execute arbitrary PHP code on the server, potentially leading to full system compromise, data theft, or disruption of service. The vulnerability requires authentication and caching to be enabled (which is the default).
Mitigation Recommendations
No official patch or fix is currently confirmed. Users should upgrade to version 6.2.1 or later once available, as the vulnerability affects versions up to 6.2.0. Until a fix is applied, consider restricting builder user permissions to trusted users only and disabling caching if feasible. Monitor the vendor advisory for updates on remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Joomla
- Date Reserved
- 2026-07-08T05:31:35.889Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5e6c122a4a8d59898880ae
Added to database: 07/20/2026, 18:42:26 UTC
Last enriched: 07/30/2026, 04:59:37 UTC
Last updated: 09/04/2026, 10:52:10 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.