CVE-2026-56290
The Joomla extension Page Builder CK (versions below 3.6.0) allows anyone on the internet to upload arbitrary files, including executable code, without authentication. This flaw can give attackers full remote code execution on the affected site. The vulnerability is rated critical with a CVSS score of 10.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Joomla extension Page Builder CK (page_builder_ck) versions older than 3.6.0, used by Joomla site administrators.
Real-world impact
An attacker can upload a malicious script or binary to the site, then run it to take full control of the web server, steal data, deface the site, or use it as a pivot for further attacks.
Why this severity
The CVSS score of 10 reflects that the flaw is exploitable from the internet, requires no authentication, and gives attackers complete control over the system. The high impact on confidentiality, integrity, and availability, combined with the ease of exploitation, drives the score to the maximum.
What to do about it
- ›Apply vendor mitigations as per instructions, ensure compliance with CISA BOD 26‑04, or discontinue use of the product if mitigations are unavailable.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
CISA KEV required action
Timeline
- Jun 29, 2026 · Jun 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 7, 2026 · 28d agoConfirmed exploited (CISA KEV)CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
- Jul 10, 2026 · 25d agoCISA remediation deadlineFederal agencies are required to remediate by this date.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- joomlack.frproduct
- forum.joomlack.fr/index.php/page-builder-ck/2…issue trackingpatch
- mysites.guru/blog/pagebuilderck-unauthen…exploitthird party advisory
- cisa.gov/known-exploited-vulnerabili…us government resource