OrdaSoft Joomla CCK: Critical SQL Injection Below 8.3.16

What CVE-2026-102428 is and who is exposedCVE-2026-102428 is an unauthenticated SQL injection in OrdaSoft Joomla CCK, a content construction kit used...

What CVE-2026-102428 is and who is exposed

CVE-2026-102428 is an unauthenticated SQL injection in OrdaSoft Joomla CCK, a content construction kit used to build custom record types and listings on Joomla sites. According to the National Vulnerability Database (NVD) of NIST, the flaw sits in the way the extension handles the order column for records: that value was supplied by the user and was not properly validated, which opens a SQL injection vector. The weakness is classified as CWE-89, improper neutralisation of special elements used in an SQL command.

The affected range is clear: OrdaSoft Joomla CCK versions up to, but not including, 8.3.16. If your site runs any release below 8.3.16, it falls inside the affected window. The NVD published the record on 5 October 2026 and scores it 9.3 under CVSS 4.0, which is a critical severity rating. The vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) tells the practical story: the attack is network-reachable, needs no privileges and no user interaction, and a successful hit compromises confidentiality, integrity and availability of the vulnerable component at a high level.

The "unauthenticated" part deserves emphasis. An attacker does not need an account, a session or any foothold on the site. Anyone who can reach the affected endpoint can attempt the injection. For a small business in Barcelona, Lleida, Tarragona or Girona running a Joomla site with this extension, that means the exposure is not limited to registered users or administrators.

Why it matters even without confirmed exploitation

To be precise about the current picture: CVE-2026-102428 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalogue, so there is no public record that it is being exploited in real attacks at the time of writing. That is a statement about what is documented, not a guarantee of safety, and it is not a reason to wait.

SQL injection remains one of the most reliably weaponised bug classes. Once a public advisory exists, automated scanners and opportunistic bots sweep the web looking for matching fingerprints, and the gap between disclosure and attempted exploitation is often measured in days. A critical, unauthenticated injection vector in a widely deployed CMS extension is exactly the profile that attracts that attention. The absence of a KEV entry should be read as "no confirmed campaigns yet", not as "not worth patching today".

What to do today

The first step is inventory, not panic. Confirm whether OrdaSoft Joomla CCK is actually installed on any of your Joomla sites, and if so, which version. Extension lists and the site's administrative panel will show this; a file-level check of the extension directory is more reliable if you suspect the admin interface has been altered.

Identify the version. Anything below 8.3.16 is in scope. Record the exact version for each affected site.
Apply the fix indicated by the vendor. The NVD record points to ordasoft.com as the product reference. Follow the vendor's advisory and update to the corrected release it specifies; do not assume a version number that is not stated in the official notice.
If you cannot update immediately, reduce exposure. Restrict access to the affected component, tighten web application firewall rules around the vulnerable parameter, and treat the extension as untrusted until it is patched.
Look for signs of intrusion. Review web server and database logs for unusual query patterns, unexpected administrative accounts, modified files or unfamiliar scheduled tasks. SQL injection often leaves traces in request logs before any visible defacement appears.
Shrink the internet-facing surface. Remove extensions you no longer use, close unused endpoints and keep Joomla core and every third-party component on a maintained release.

Under GDPR, a confirmed compromise that exposes personal data carries notification obligations, so the sooner you can rule out intrusion, the better positioned you are to meet them.

How a cybersecurity team like ALMC's fits in

Most SMEs and online shops in Spain do not have a security analyst watching advisories every morning. That is the gap ALMC works in: security audits and pentesting to find weaknesses before they are found for you, hardening of servers and CMS installations, and maintenance of WordPress, PrestaShop and Joomla sites so that patches like this one land on time instead of sitting in a backlog. When something does go wrong, incident response and the repair of a hacked website are part of the same service, which means the same team that knows your stack is the one that cleans it up. For a business with a small IT team or none at all, that continuity is often the difference between a routine update and a very bad week.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.