Affected versions: ≥ 3.6.4 and < 3.6.5
Full advisory: our disclosure post
CVE-2026-77994CriticalCVSS 9.3CVE published 24 August 2026Added to mySites.guru 17 August 2026
Page Builder CK (com_pagebuilderck) 3.6.4 - SQL Injection in the styles model, backend vector still open
Page Builder CK 3.6.4 is still affected by CVE-2026-74254, the SQL injection in the styles handling, because that release only fixed half of it. The CNA records the whole issue as affecting versions 1.0.0 to 3.6.4 and scores it CVSS 4.0 9.3 Critical: 3.6.4 fixed the front-end vector, and 3.6.5 fixed the administrator one. On 3.6.4 specifically the remaining route is the administrator path, where the sanitising call discarded its own return value so the uncast style identifiers still reached the query, and reaching it needs an authenticated account with content editing rights on the component plus a valid session token. That is why this rule is scored lower than the 3.6.3 rule even though both carry the same CVE. Update to 3.6.5 or later, which applies the sanitising properly. Until you can update, restrict edit permissions on com_pagebuilderck to trusted users only.
Is my site affected?
CVE-2026-77994 is checked by 2 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| Page Builder CK | from 3.6.4 up to but not including 3.6.5 | 3.6.5 | Update Page Builder CK to 3.6.5 or later. |
| Page Builder CK | from 3.6.0 up to but not including 3.6.5 | 3.6.5 | Update Page Builder CK to 3.6.5 or later. |
How CVE-2026-77994 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
9.3 Critical
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:H Confidentiality
- High. Everything the site holds can be read
- VI:H Integrity
- High. Data and files can be altered at will
- VA:H Availability
- High. The site can be taken down
What it does beyond the site
- SC:N Confidentiality
- None. Other systems keep their data
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
The rule below is rated High for the set of 3 CVEs it covers together, not for this record on its own.
Timeline
- 21 July 2026We published: PageBuilder CK RCE fixed - again - correctly this time
- 17 August 2026mySites.guru check added for Page Builder CK (from 3.6.4 up to but not including 3.6.5)
- 24 August 2026CVE-2026-77994 record published by its CNA
Rule details
Page Builder CK - Page Builder CK (com_pagebuilderck) below 3.6.5 - Unauthenticated SQL Injection (CVE-2026-77994, CVSS 9.3 Critical) and Reflected XSS
Page Builder CK versions 1.0.0 to 3.6.4 are affected by two unauthenticated vulnerabilities published by the Joomla CNA on 24 August 2026. CVE-2026-77994 (CVSS 9.3 Critical, CWE-89) is a second order SQL injection in the loadStyles method of the frontend page model. The CVSS vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, so no login, no CSRF token and no user interaction are required: an anonymous visitor can read and modify the entire Joomla database, including the password hashes in #__users. CVE-2026-77993 (CVSS 5.3 Medium, CWE-79) is a reflected cross-site scripting flaw via the iscontenttype parameter. It is also unauthenticated, but needs the victim to follow a crafted link (UI:P). Both are fixed in Page Builder CK 3.6.5. Both were reported by Ala Arfaoui. Update to 3.6.5 or later. Page Builder CK has shipped a run of security releases across the 3.6.x line, so an earlier 3.6.x build is not a safe ceiling. If you cannot update straight away, block anonymous requests to index.php?option=com_pagebuilderck at your web server or WAF. Because the SQL injection is unauthenticated and reachable on the front end, treat any database contents as potentially read and rotate administrator passwords after updating.
Affected versions: ≥ 3.6.0 and < 3.6.5
Full advisory: www.cve.org
Our disclosure post
Other vulnerabilities in Page Builder CK
Updating for CVE-2026-77994 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
Page Builder CK
Latest safe version: 3.6.5
- CVE-2026-63048 Critical, from 3.1.1 up to but not including 3.1.4
- CVE-2026-56290 Critical, before 3.1.1
- CVE-2026-74254 Critical, from 3.6.3 up to but not including 3.6.4
- CVE-2026-77993 High, from 3.6.4 up to but not including 3.6.5
- CVE-2026-62414 Medium, from 3.6.0 up to and including 3.6.1
References
- CVE-2026-77994 on cve.org (the official CVE record)
- CVE-2026-77994 in the NIST National Vulnerability Database
- PageBuilder CK RCE fixed - again - correctly this time
CVE-2026-77994 questions
Which versions are affected by CVE-2026-77994?
CVE-2026-77994 is covered by 2 rules: Page Builder CK from 3.6.4 up to but not including 3.6.5; Page Builder CK from 3.6.0 up to but not including 3.6.5.
How do I fix CVE-2026-77994?
It depends on the extension and release line your site runs. For Page Builder CK from 3.6.4 up to but not including 3.6.5: update Page Builder CK to 3.6.5 or later. For Page Builder CK from 3.6.0 up to but not including 3.6.5: update Page Builder CK to 3.6.5 or later.
How severe is CVE-2026-77994?
Joomla CNA scores it 9.3 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 October 2026.