CVE-2026-102782CriticalCVSS 9.3CVE published 7 October 2026Added to mySites.guru 7 October 2026

OrdaSoft Simple Membership (com_simplemembership) below 7.4.0 - Unauthenticated SQL Injection

Q: Which versions are affected by CVE-2026-102782?

CVE-2026-102782 affects OrdaSoft Simple Membership from 1.0.0 up to but not including 7.4.0. The fix is in 7.4.0.

Q: How do I fix CVE-2026-102782?

Update OrdaSoft Simple Membership to 7.4.0 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.

Q: How severe is CVE-2026-102782?

Joomla CNA scores it 9.3 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

OrdaSoft Simple Membership versions before 7.4.0 are vulnerable to unauthenticated SQL injection. site/simplemembership.php dispatches task=checkLoginPass with no authentication or access check, reads a login parameter through Joomla's generic input filter (which strips tags but leaves quotes and SQL syntax intact) and concatenates it straight into a database query. An anonymous visitor can read or alter database contents, including user accounts and password hashes. Update to 7.4.0 or later. OrdaSoft has published no advisory or changelog; the fixed version comes from the CVE record. Until a fixed version is installed, disable the component or block requests with task=checkLoginPass at the web server.

Is my site affected?

Affected: OrdaSoft Simple Membership from 1.0.0 up to but not including 7.4.0
Fixed in: 7.4.0
What to do: Update OrdaSoft Simple Membership to 7.4.0 or later.

Check whether your sites are affected

How CVE-2026-102782 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

9.3 Critical

CVSS 4.0, scored by Joomla CNA

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

How it is reached

AV:N Attack vector: Network. Reachable across the internet
AC:L Attack complexity: Low. Nothing to work around, it just works
AT:N Attack requirements: None. Works against any affected install
PR:N Privileges required: None. No account needed
UI:N User interaction: None. Nobody has to be tricked into anything

What it does to the site

VC:H Confidentiality: High. Everything the site holds can be read
VI:H Integrity: High. Data and files can be altered at will
VA:H Availability: High. The site can be taken down

What it does beyond the site

SC:N Confidentiality: None. Other systems keep their data
SI:N Integrity: None. Other systems keep their integrity
SA:N Availability: None. Other systems stay up

Timeline

7 October 2026CVE-2026-102782 record published by its CNA
7 October 2026mySites.guru check added for OrdaSoft Simple Membership (from 1.0.0 up to but not including 7.4.0)
7 October 2026We published: OrdaSoft Simple Membership and Touch Slider for Joomla: Two Flaws That Need No Login

Rule details

CriticalCVE-2026-1027822026-10-07

OrdaSoft Simple Membership

Affected versions: ≥ 1.0.0 and < 7.4.0

Full advisory: our disclosure post

Our disclosure post

OrdaSoft Simple Membership and Touch Slider for Joomla: Two Flaws That Need No Login

Simple Membership for Joomla has an SQL injection in its login check, CVSS 9.3, and Touch Slider lets anyone delete or replace its slides. Versions and fixes.

7 Oct 2026

Other vulnerabilities in OrdaSoft Simple Membership and OrdaSoft Simple Membership

Updating for CVE-2026-102782 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.