CVE-2026-60026 is a code injection vulnerability (CWE-94) in the themexpert.com Quix Page Builder Pro extension for Joomla. Authenticated users with appropriate permissions can inject PHP code into element content, which is then executed due to the caching mechanism's use of include() on cached views. This enables PHP code execution within the context of the Joomla application. The vulnerability requires caching to be enabled (default setting) and affects versions =1.0-6.2.0 of the extension. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation allows authenticated users with core.create or core.edit permissions to execute arbitrary PHP code on the server, potentially leading to full compromise of the Joomla installation and underlying system. This can result in unauthorized access, data theft, or further system manipulation. The vulnerability requires authentication but has a low attack complexity and no user interaction, making it a significant risk in environments where such user privileges are granted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling caching in the Quix Page Builder Pro extension to prevent execution of injected PHP code via the view-cache include() mechanism. Additionally, restrict core.create and core.edit permissions to trusted users only to limit exposure.