Affected versions: < 4.6.2
Full advisory: our disclosure post
CVE-2026-62415CriticalCVSS 9.1CVE published 21 July 2026Added to mySites.guru 21 July 2026
Membership Pro (com_osmembership) below 4.6.2 - Unauthenticated File Upload
Membership Pro versions below 4.6.2 expose an unauthenticated file upload endpoint used by subscribers during the subscription process when the site uses File custom fields. This is the same class of unauthenticated upload flaw found in Events Booking from the same developer (JoomDonation / Ossolution), which mySites.guru documented at https://mysites.guru/blog/events-booking-unauthenticated-upload-user-enumeration/. In 4.6.2 (released 2026-07-21) the upload endpoint is automatically disabled when the site uses no File custom fields, and when File custom fields are in use additional validation and abuse protection have been added. The vendor classifies the issue as abuse of upload storage (anonymous users filling hosting space with unwanted files) rather than remote code execution, and states attackers could not upload executable files, steal data, or take control of the site. Fix: update to 4.6.2 or later. After updating, run the Membership Pro cleanup tool to delete any unauthenticated upload files left behind before the update, and optionally configure the new scheduled task to clean them up going forward.
Is my site affected?
- Affected
- Membership Pro before 4.6.2
- Fixed in
- 4.6.2
- What to do
- Update Membership Pro to 4.6.2 or later.
How CVE-2026-62415 is scored
The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
9.1 Critical
CVSS 3.1, scored by CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
- S:U Scope
- Unchanged. Contained to the extension it is in
What it does
- C:H Confidentiality
- High. Everything the site holds can be read
- I:H Integrity
- High. Data and files can be altered at will
- A:N Availability
- None. The site stays up
mySites.guru rates this Medium. Where our assessment and the published record differ, your sites are checked against ours.
Timeline
- 21 July 2026CVE-2026-62415 record published by its CNA
- 21 July 2026mySites.guru check added for Membership Pro (before 4.6.2)
- 21 July 2026We published: Membership Pro 4.6.2: A Quiet Fix for Anonymous File Uploads
Rule details
Our disclosure post
Other vulnerabilities in Membership Pro
Updating for CVE-2026-62415 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
Membership Pro
Latest safe version: 4.6.2
References
- CVE-2026-62415 on cve.org (the official CVE record)
- CVE-2026-62415 in the NIST National Vulnerability Database
- Membership Pro 4.6.2: A Quiet Fix for Anonymous File Uploads
CVE-2026-62415 questions
Which versions are affected by CVE-2026-62415?
CVE-2026-62415 affects Membership Pro before 4.6.2. The fix is in 4.6.2.
How do I fix CVE-2026-62415?
Update Membership Pro to 4.6.2 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2026-62415?
CISA-ADP scores it 9.1 (Critical) under CVSS 3.1. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 October 2026.