CVE-2026-60031 is an information disclosure vulnerability (CWE-200) in the Quix Page Builder Pro extension for Joomla. The issue arises because raw exception messages are returned in AJAX handler responses, potentially exposing sensitive internal information to unauthorized actors. This vulnerability affects versions 1.0 through 6.2.0 of the extension. The CVSS 4.0 vector indicates the vulnerability is remotely exploitable without authentication and requires low attack complexity. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Unauthorized actors may gain access to sensitive internal information through exception messages exposed in AJAX responses. This could aid attackers in further reconnaissance or exploitation efforts. However, the vulnerability does not require user interaction or privileges and has a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected AJAX endpoints or implementing custom error handling to prevent raw exception details from being exposed.