CVE-2026-64876 describes a CSRF vulnerability in the GeoIP extension for Joomla developed by regularlabs.com. The issue arises from inconsistent enforcement of CSRF tokens and Super User privilege checks on database-update operations. This inconsistency could permit attackers to execute unauthorized updates via crafted requests that bypass intended protections. The vulnerability affects versions 1.0.0 through 6.3.8 of the extension. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could lead to unauthorized modification of the extension's database, potentially compromising the integrity and availability of the Joomla site using this extension. Given the high CVSS score (8.8), the impact includes high confidentiality, integrity, and availability consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the GeoIP extension or restricting access to trusted users only. Monitoring for unusual update requests and applying web application firewall (WAF) rules to block CSRF attempts may provide temporary mitigation.