Four vendors. Five extensions. Twenty flaws.

Since the last newsletter, four vendors have patched twenty flaws we found and reported to them privately, across five Joomla extensions: J2Store, SP Page Builder, SP Property Finder, T4 Page Builder and DPCalendar. Two of the twenty are reachable by any anonymous visitor. One sits in a shop's public product list, the other in a property search, and either one reads the whole database a character at a time, Super User password hash included.

J2Store accounts for eleven of the twenty, in two rounds a fortnight apart. J2Commerce fixed the first five on 31 August, and reviewing that release turned up six more, out today in 3.3.23, 4.0.23 and 4.1.8. Take the fix for your own branch rather than the highest number: 4.1.8 sorts above the rest while being wrong for most shops and impossible to install on Joomla 3.

Two vendors shipped large releases of their own. Regular Labs put out 24 extension updates in a single day, ten of them security fixes, and Digital Peak patched four extensions out of band after an audit run with Claude. There is also a free release tracker that needs no account, a rebuilt user manager, a File Manager that now reaches Joomla 3 and Joomla 4, and the 50,000 live robots.txt files we read, where a lot of people have deleted themselves from ChatGPT while meaning to opt out of AI training.

All of it free to read on the blog

New

Six more J2Store flaws, fixed today in 3.3.23, 4.0.23 and 4.1.8

The worst of the six needs nothing at all. The storefront product list takes a filter value straight out of the request, without quoting it, and drops it into a database query. Alongside it sits an arbitrary file read that returns configuration.php from outside the shop's own folders. All three supported branches are affected, so whichever Joomla version your shop runs, it needs updating today.

Everything else that needed patching

Free

Release Radar, a free Joomla and WordPress release tracker

If a Joomla extension developer shipped a new version this morning, how would you find out? For most people the answer is that they would not, at least not on purpose. Release Radar is a public log of new Joomla and WordPress releases, including the commercial ones the plugin directories miss. It needs no account, and it has an RSS feed and a JSON endpoint. We have been sitting on this data for fourteen years and deleting it twice a day.

Away from the patching

Need help with your site? Phil Taylor – Fixing websites since 2004

Found something wrong with your Joomla or WordPress site? If it were simple, you'd have fixed it already. I offer same-day expert help at a flat rate of £120 per incident. No hourly billing surprises.

If I can't add value, you don't pay