# Phoca Cart security vulnerabilities [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/Phoca Cart # Phoca Cart security vulnerabilities mySites.guru tracks 7 vulnerabilities in Phoca Cart (com\_phocacart), covering 4 CVEs. Every connected Joomla site is checked against them on each audit. ## Is my site affected? Your site is affected if it runs Phoca Cart in any of these ranges: - from 3.0.0 up to but not including 6.1.9 - from 6.1.7 up to but not including 6.1.8 - from 6.0.0 up to but not including 6.1.7 - from 5.0.0 up to but not including 5.2.4 - from 5.2.4 up to and including 5.2.4 - from 4.0.0 up to but not including 4.0.13 - from 3.0.0 up to but not including 4.0.0 - **Latest safe version** - 6.1.9 or later. No rule we check matches that release or any newer one. - **What to do** - Update Phoca Cart to 6.1.9 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## Every Phoca Cart vulnerability we track Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses. CVE Affected versions Fixed in Severity Added [CVE-2026-102775](https://mysites.guru/vulnerabilities/CVE-2026-102775/)CVSS 8.7 from 3.0.0 up to but not including 6.1.9 6.1.9 High 2026-10-01 [CVE-2026-74251](https://mysites.guru/vulnerabilities/CVE-2026-74251/)CVSS 9.3 from 3.0.0 up to but not including 4.0.0 4.0.0 Critical \- [CVE-2026-74251](https://mysites.guru/vulnerabilities/CVE-2026-74251/)CVSS 9.3 from 4.0.0 up to but not including 4.0.13 4.0.13 Critical \- [CVE-2026-74251](https://mysites.guru/vulnerabilities/CVE-2026-74251/)CVSS 9.3 from 5.0.0 up to but not including 5.2.4 5.2.4 Critical \- [CVE-2026-74251](https://mysites.guru/vulnerabilities/CVE-2026-74251/)CVSS 9.3 from 6.0.0 up to but not including 6.1.7 6.1.7 Critical \- [CVE-2026-76564](https://mysites.guru/vulnerabilities/CVE-2026-76564/)CVSS 8.6[CVE-2026-76565](https://mysites.guru/vulnerabilities/CVE-2026-76565/)CVSS 5.3 from 6.1.7 up to but not including 6.1.8 6.1.8 Medium \- No CVE id from 5.2.4 up to and including 5.2.4 after 5.2.4 Medium \- ## What we check for Critical[CVE-2026-74251](https://mysites.guru/vulnerabilities/CVE-2026-74251/) ### Phoca Cart (com\_phocacart) 3.x - Unauthenticated SQL Injection in the product filter, no fixed release (CVE-2026-74251) Phoca Cart builds the product filter query by concatenating the a (attribute) and s (specification) request parameters straight into the WHERE clause inside hand-written quotes, instead of passing them through the database quoting. The front-end product listing model reads both parameters from the request using the Joomla array filter, which does not sanitise the values inside the array, so any anonymous visitor can reach the injection on a public product or category listing page with no account and no token. Phoca fixed this on 16 August 2026 in 5.2.4 (Joomla 5 line) and 6.1.7 (Joomla 6 line). The Joomla 3 line was NOT patched: 3.5.8 is the newest 3.x release and it still contains the identical vulnerable code, so every 3.x version is affected with no fixed release available. There is no in-branch remedy. Migrate the site to a supported Joomla version and install the patched Phoca Cart, or remove the extension. The Joomla CNA published CVE-2026-74251 for this flaw on 16 August 2026, scoring it CVSS 4.0 9.3 Critical (CWE-89). The published affected range starts at 5.0.0, so it does not formally cover the 3.x branch, but we extracted 3.5.8 and confirmed the identical unpatched code, which is why this rule flags it. Affected versions: ≥ 3.0.0 and < 4.0.0 Full advisory: [our disclosure post](https://mysites.guru/blog/phoca-cart-sql-injection-product-filter/) Critical[CVE-2026-74251](https://mysites.guru/vulnerabilities/CVE-2026-74251/) ### Phoca Cart (com\_phocacart) below 4.0.13 - Unauthenticated SQL Injection in the product filter (CVE-2026-74251) Phoca Cart builds the product filter query by concatenating the a (attribute) and s (specification) request parameters straight into the WHERE clause inside hand-written quotes, instead of passing them through the database quoting. The front-end product listing model reads both parameters from the request using the Joomla array filter, which does not sanitise the values inside the array, so any anonymous visitor can reach the injection on a public product or category listing page with no account and no token. Phoca fixed this on 16 August 2026 across three branches: 6.1.7 at 10:23 UTC, 5.2.4 sixteen minutes later, and 4.0.13 for the Joomla 4 line the same evening at 20:39 UTC. Update to 4.0.13 or later on the 4.x branch. The fix is in admin/libraries/phocacart/search/search.php and routes every filter value through $db->quote(); we confirmed it by extracting and diffing the shipped com\_phocacart\_v4.0.12.zip and com\_phocacart\_v4.0.13.zip packages rather than comparing git tags, which do not correspond to the released code on this project. The 4.x file has four injection points where the 5.x and 6.x files have six, because the 4.x line predates the multilingual code path. The Joomla CNA published CVE-2026-74251 on 16 August 2026, scoring it CVSS 4.0 9.3 Critical (CWE-89). The published affected range starts at 5.0.0 and does not formally cover the 4.x branch, but the identical vulnerable code is present in 4.0.12 and earlier, which is why this rule flags it. Affected versions: ≥ 4.0.0 and < 4.0.13 Full advisory: [our disclosure post](https://mysites.guru/blog/phoca-cart-sql-injection-product-filter/) Critical[CVE-2026-74251](https://mysites.guru/vulnerabilities/CVE-2026-74251/) ### Phoca Cart (com\_phocacart) below 5.2.4 - Unauthenticated SQL Injection in the product filter (CVE-2026-74251) Phoca Cart builds the product filter query by concatenating the a (attribute) and s (specification) request parameters straight into the WHERE clause inside hand-written quotes, instead of passing them through the database quoting. The front-end product listing model reads both parameters from the request using the Joomla array filter, which does not sanitise the values inside the array, so any anonymous visitor can reach the injection on a public product or category listing page with no account and no token. Update to Phoca Cart 5.2.4 or later on the Joomla 5 line. Note that Joomla 5 sites running a Phoca Cart 6.x version will NOT be offered this fix by the Joomla updater, because the update feed maps Joomla 5 to the 5.x release and 5.2.4 sorts lower than the installed 6.x version, so the update screen shows nothing: those sites need the 6.1.7 package installed manually. The Joomla CNA published CVE-2026-74251 for this flaw on 16 August 2026, scoring it CVSS 4.0 9.3 Critical (CWE-89). Affected versions: ≥ 5.0.0 and < 5.2.4 Full advisory: [our disclosure post](https://mysites.guru/blog/phoca-cart-sql-injection-product-filter/) Critical[CVE-2026-74251](https://mysites.guru/vulnerabilities/CVE-2026-74251/) ### Phoca Cart (com\_phocacart) below 6.1.7 - Unauthenticated SQL Injection in the product filter (CVE-2026-74251) Phoca Cart builds the product filter query by concatenating the a (attribute) and s (specification) request parameters straight into the WHERE clause inside hand-written quotes, instead of passing them through the database quoting. The front-end product listing model reads both parameters from the request using the Joomla array filter, which does not sanitise the values inside the array, so any anonymous visitor can reach the injection on a public product or category listing page with no account and no token. Update to Phoca Cart 6.1.7 or later. If this site runs Joomla 5 rather than Joomla 6, the Joomla updater will NOT offer 6.1.7: the update feed maps Joomla 5 to the 5.x release and 5.2.4 sorts lower than the installed 6.x version, so the update screen reports nothing to update. Download the 6.1.7 package from GitHub or phoca.cz and install it through Extensions, Install, Upload Package File. The Joomla CNA published CVE-2026-74251 for this flaw on 16 August 2026, scoring it CVSS 4.0 9.3 Critical (CWE-89). The record states the affected range as 5.0.0-6.1.16; there is no Phoca Cart 6.1.16, the highest release on the 6.x line is 6.1.7 and that is the build containing the fix, so read the upper bound as 6.1.6. Affected versions: ≥ 6.0.0 and < 6.1.7 Full advisory: [our disclosure post](https://mysites.guru/blog/phoca-cart-sql-injection-product-filter/) High[CVE-2026-102775](https://mysites.guru/vulnerabilities/CVE-2026-102775/)2026-10-01 ### Phoca Cart (com\_phocacart) below 6.1.9 - Unauthenticated Order Download IDOR (paid file disclosure) Phoca Cart before 6.1.9 does not check who is downloading a purchased file. The order download task loads the ordered file by its numeric id and only checks that the download token and order token sent with the request are not empty. It never compares them with the tokens stored for that order. No login is required: an anonymous visitor who sends any non-empty values for both tokens can step through the sequential download ids and fetch the digital products other customers paid for. Only shops that sell downloadable products are exposed, and the per-file download count and day limits still apply. Phoca describes it as an authorisation bypass through a user-controlled key (IDOR) in the order view. Phoca Cart 6.1.9 (1 October 2026) requires the logged-in owner of the order, or both stored tokens matched exactly. The fix has shipped on the 6.x branch only. The current 5.x release (5.2.4), 4.x release (4.0.13) and 3.x release (3.5.8) all have the same unchecked code and no fixed release. Joomla 5 and Joomla 6 sites should install the 6.1.9 package (a Joomla 5 site is offered the 5.x line by the updater, so install pkg\_phocacart\_v6.1.9.zip by hand). Joomla 3 and Joomla 4 sites have no fix: unpublish downloadable products, or move to Joomla 5 or 6 and Phoca Cart 6.1.9. A CVE has been announced by Phoca but not yet published. Affected versions: ≥ 3.0.0 and < 6.1.9 Full advisory: [our disclosure post](https://mysites.guru/blog/phoca-cart-6-1-9-download-idor/) Medium[CVE-2026-76564](https://mysites.guru/vulnerabilities/CVE-2026-76564/)[CVE-2026-76565](https://mysites.guru/vulnerabilities/CVE-2026-76565/) ### Phoca Cart (com\_phocacart) 6.1.7 - Unauthenticated Reflected XSS in the product price filter Phoca Cart echoes the price\_from and price\_to request parameters straight into the value attribute of the product filter text inputs, in the site layouts form\_filter\_text.php and form\_filter\_horizontal\_text.php, with no escaping. No login is required: a crafted link to a shop category or product list page whose price\_from value contains a double quote breaks out of the attribute and runs attacker script in the browser of anyone who opens it. The filter panel is rendered on the public shop pages whenever the price filter is enabled. 6.1.8 wraps both values in htmlspecialchars with ENT\_QUOTES and ENT\_SUBSTITUTE, and also escapes an unescaped value in the administrator Phoca Render Adminview helper. Confirmed by diffing the released com\_phocacart zips on 2026-08-18. Update to 6.1.8. Note that 6.1.7 was itself the fix for the CVE-2026-74251 product filter SQL injection, so a site on 6.1.7 is exposed to this cross site scripting issue only, not to the SQL injection. Affected versions: ≥ 6.1.7 and < 6.1.8 Full advisory: [github.com](https://github.com/PhocaCz/PhocaCart/releases/tag/6.1.8) Medium ### Phoca Cart (com\_phocacart) 5.2.4 - Unauthenticated Reflected XSS in the product price filter, no fixed 5.x release Phoca Cart echoes the price\_from and price\_to request parameters straight into the value attribute of the product filter text inputs, in the site layouts form\_filter\_text.php and form\_filter\_horizontal\_text.php, with no escaping. No login is required: a crafted link to a shop category or product list page whose price\_from value contains a double quote breaks out of the attribute and runs attacker script in the browser of anyone who opens it. The filter panel is rendered on the public shop pages whenever the price filter is enabled. 6.1.8 wraps both values in htmlspecialchars with ENT\_QUOTES and ENT\_SUBSTITUTE, and also escapes an unescaped value in the administrator Phoca Render Adminview helper. Confirmed by diffing the released com\_phocacart zips on 2026-08-18. The escaping fix has so far shipped on the 6.x branch only, in 6.1.8. Version 5.2.4 is the current 5.x release, and the released com\_phocacart\_v5.2.4.zip was checked on 2026-08-18 and still ships both filter layouts unescaped, so there is no fixed 5.x release yet. Move to 6.1.8 if the site can run the 6.x branch, otherwise disable the price filter until Phoca backports the fix. Versions below 5.2.4 are already flagged for the CVE-2026-74251 SQL injection. Affected versions: ≥ 5.2.4 and ≤ 5.2.4 Full advisory: [github.com](https://github.com/PhocaCz/PhocaCart/releases/tag/6.1.8) ## Timeline 1. 16 August 2026[CVE-2026-74251 record published](https://mysites.guru/vulnerabilities/CVE-2026-74251/) 2. 20 August 2026[CVE-2026-76564 record published](https://mysites.guru/vulnerabilities/CVE-2026-76564/) 3. 20 August 2026[CVE-2026-76565 record published](https://mysites.guru/vulnerabilities/CVE-2026-76565/) 4. 1 October 2026Check added for CVE-2026-102775 (from 3.0.0 up to but not including 6.1.9) 5. 5 October 2026[CVE-2026-102775 record published](https://mysites.guru/vulnerabilities/CVE-2026-102775/) ## References - [Phoca Cart 5.2.4, 6.1.7 and 4.0.13 fix a front-end SQL injection](https://mysites.guru/blog/phoca-cart-sql-injection-product-filter/) - [Phoca Cart 6.1.9 stops anyone downloading other customers' paid files](https://mysites.guru/blog/phoca-cart-6-1-9-download-idor/) - [github.com/PhocaCz/PhocaCart/releases/tag/6.1.8](https://github.com/PhocaCz/PhocaCart/releases/tag/6.1.8) Each CVE page above links its official cve.org record and its NVD entry. ## Phoca Cart vulnerability questions Show all Which versions of Phoca Cart are vulnerable? mySites.guru tracks 7 vulnerabilities in Phoca Cart (com\_phocacart). A site is affected if its installed version is in any of these ranges: from 3.0.0 up to but not including 6.1.9; from 6.1.7 up to but not including 6.1.8; from 6.0.0 up to but not including 6.1.7; from 5.0.0 up to but not including 5.2.4; from 5.2.4 up to and including 5.2.4; from 4.0.0 up to but not including 4.0.13; from 3.0.0 up to but not including 4.0.0. What is the latest safe version of Phoca Cart? 6.1.9. Every vulnerability tracked here is fixed by 6.1.9, and no rule we check matches that release or any later one. How do I check which version of Phoca Cart my Joomla site runs? The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com\_phocacart. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules. ## Running Phoca Cart on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). CVE identifiers: [CVE-2026-74251](https://mysites.guru/vulnerabilities/CVE-2026-74251/), [CVE-2026-102775](https://mysites.guru/vulnerabilities/CVE-2026-102775/), [CVE-2026-76564](https://mysites.guru/vulnerabilities/CVE-2026-76564/), [CVE-2026-76565](https://mysites.guru/vulnerabilities/CVE-2026-76565/). Rules current as of 14 October 2026.