CVE-2026-78072: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Jefferson49 Sexy Polling Reloaded extension for Joomla

This vulnerability (CVE-2026-78072) affects the Sexy Polling Reloaded extension for Joomla developed by Jefferson49. Versions from 1.0.0 up to and including 5.6.0 are vulnerable to an unauthenticated blind SQL injection attack, classified under CWE-89. The flaw arises from improper neutralization of special elements used in SQL commands, enabling attackers to inject SQL code without authentication. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can exploit this vulnerability to perform blind SQL injection attacks against the vulnerable Joomla extension, potentially leading to unauthorized data access or manipulation. The high CVSS score reflects the significant confidentiality impact and ease of exploitation without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the vulnerable extension to prevent exploitation.