The JMedia extension for Joomla, developed by themexpert.com, versions 1.0 up to 1.5.4, is affected by an SSRF vulnerability (CWE-918). This vulnerability arises from the extension's remote download functionality, which does not properly restrict URLs, allowing an attacker to induce the server to make HTTP requests to internal or reserved IP addresses. This could potentially expose internal resources or services not otherwise accessible externally. The vulnerability has been assigned CVE-2026-60033 and carries a CVSS 4.0 score of 5.1, reflecting medium severity. There is no vendor advisory or patch information currently available, and no known exploits have been reported in the wild.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the Joomla server running the vulnerable JMedia extension to make unauthorized requests to internal or reserved network addresses. This may lead to unauthorized access to internal services or information disclosure within the internal network. However, the vulnerability does not require user interaction and has a medium severity rating, indicating a moderate impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor the themexpert.com and Joomla advisories for updates. Until a patch is released, consider restricting or disabling the remote download feature in the JMedia extension if possible, or apply network-level controls to limit the server's ability to make outbound requests to internal or sensitive IP ranges.