Articles Calendar
Affected versions: ≤ 1.0.1.0007
Full advisory: nvd.nist.gov
CVE-2025-26855CriticalCVSS 9.8CVE published 18 July 2025Added to mySites.guru 18 July 2025
Articles Calendar (mod_articles_calendar) 1.0.1.0007 and below - Unauthenticated SQL Injection (Full Database Disclosure)
The Articles Calendar extension by JoomCar (joomcar.net), versions 1.0.0 through 1.0.1.0007, contains an SQL injection flaw reachable without authentication. An anonymous visitor can execute arbitrary SQL against the site database, which means full read access to every table including the Joomla user table and its password hashes. CVSS 9.8 (Critical). No fixed version has been published by the vendor. Remove the extension, or block access to it, until JoomCar ships a patched release. This rule covers the "Articles - Calendar" site module half of the package; the companion system plugin is covered by a separate rule on articlescalendar.
Is my site affected?
CVE-2025-26855 is checked by 2 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| Articles Calendar | up to and including 1.0.1.0007 | after 1.0.1.0007 | Update Articles Calendar to the newest release from the vendor. This flaw covers versions up to 1.0.1.0007, so any later release is outside it. |
| Articles Calendar | up to and including 1.0.1.0007 | after 1.0.1.0007 | Update Articles Calendar to the newest release from the vendor. This flaw covers versions up to 1.0.1.0007, so any later release is outside it. |
How CVE-2025-26855 is scored
The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
9.8 Critical
CVSS 3.1, scored by CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
- S:U Scope
- Unchanged. Contained to the extension it is in
What it does
- C:H Confidentiality
- High. Everything the site holds can be read
- I:H Integrity
- High. Data and files can be altered at will
- A:H Availability
- High. The site can be taken down
Timeline
- 18 July 2025CVE-2025-26855 record published by its CNA
- 18 July 2025mySites.guru check added for Articles Calendar (up to and including 1.0.1.0007)
- 18 July 2025mySites.guru check added for Articles Calendar (up to and including 1.0.1.0007)
Rule details
Articles Calendar - Articles Calendar (articlescalendar) 1.0.1.0007 and below - Unauthenticated SQL Injection (Full Database Disclosure)
The Articles Calendar extension by JoomCar (joomcar.net), versions 1.0.0 through 1.0.1.0007, contains an SQL injection flaw reachable without authentication. An anonymous visitor can execute arbitrary SQL against the site database, which means full read access to every table including the Joomla user table and its password hashes. CVSS 9.8 (Critical). No fixed version has been published by the vendor. Remove the extension, or block access to it, until JoomCar ships a patched release. This rule covers the "System - Articles Calendar" plugin half of the package; the companion site module is covered by a separate rule on mod_articles_calendar.
Affected versions: ≤ 1.0.1.0007
Full advisory: nvd.nist.gov
References
- CVE-2025-26855 on cve.org (the official CVE record)
- CVE-2025-26855 in the NIST National Vulnerability Database
CVE-2025-26855 questions
Which versions are affected by CVE-2025-26855?
CVE-2025-26855 is covered by 2 rules: Articles Calendar up to and including 1.0.1.0007; Articles Calendar up to and including 1.0.1.0007.
How do I fix CVE-2025-26855?
It depends on the extension and release line your site runs. For Articles Calendar up to and including 1.0.1.0007: update Articles Calendar to the newest release from the vendor. This flaw covers versions up to 1.0.1.0007, so any later release is outside it. For Articles Calendar up to and including 1.0.1.0007: update Articles Calendar to the newest release from the vendor. This flaw covers versions up to 1.0.1.0007, so any later release is outside it.
How severe is CVE-2025-26855?
CISA-ADP scores it 9.8 (Critical) under CVSS 3.1. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 October 2026.