CVE-2026-77994: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in joomlack.fr Page Builder CK extension for Joomla

CVE-2026-77994 describes a second order SQL injection vulnerability in the Joomla extension Page Builder CK, specifically in versions up to 3.6.4. The issue arises from improper sanitization in the loadStyles method of the frontend page model, allowing an attacker to inject malicious SQL commands. The vulnerability is critical with a CVSS 4.0 score of 9.3, reflecting high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or denial of service. The vulnerability requires no privileges or user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications and consider temporary mitigations such as disabling or restricting access to the vulnerable extension if feasible.