Membership Pro
Affected versions: < 4.6.2
Full advisory: our disclosure post
CVE-2026-62415MediumPublished 21 July 2026
Membership Pro (com_osmembership) below 4.6.2 - Unauthenticated File Upload
Membership Pro versions below 4.6.2 expose an unauthenticated file upload endpoint used by subscribers during the subscription process when the site uses File custom fields. This is the same class of unauthenticated upload flaw found in Events Booking from the same developer (JoomDonation / Ossolution), which mySites.guru documented at https://mysites.guru/blog/events-booking-unauthenticated-upload-user-enumeration/. In 4.6.2 (released 2026-07-21) the upload endpoint is automatically disabled when the site uses no File custom fields, and when File custom fields are in use additional validation and abuse protection have been added. The vendor classifies the issue as abuse of upload storage (anonymous users filling hosting space with unwanted files) rather than remote code execution, and states attackers could not upload executable files, steal data, or take control of the site. Fix: update to 4.6.2 or later. After updating, run the Membership Pro cleanup tool to delete any unauthenticated upload files left behind before the update, and optionally configure the new scheduled task to clean them up going forward.
Affected versions: < 4.6.2
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.