CVE-2026-62415 - Vulnerability Details - OpenCVE

Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Joomdonation.com	Membership Pro Extension For Joomla

No data.

No data.

References

Link	Providers
https://joomdonation.com/joomla-extensions/membership-pro-joomla-membership-subscription.html

History

Thu, 23 Jul 2026 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Joomdonation.com Joomdonation.com membership Pro Extension For Joomla
Vendors & Products		Joomdonation.com Joomdonation.com membership Pro Extension For Joomla

Thu, 23 Jul 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description	The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.	Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.

Tue, 21 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 21 Jul 2026 10:15:00 +0000

Type	Values Removed	Values Added
Description		The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.
Title		Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2
Weaknesses		CWE-1188
References		https://joomdonation.com/joomla-extensions/membership-pro-joomla-membership-subscription.html

MITRE

Status: PUBLISHED

Assigner: Joomla

Published: 2026-07-21T09:19:19.754Z

Updated: 2026-07-23T15:01:08.350Z

Reserved: 2026-07-14T05:16:10.070Z

Link: CVE-2026-62415

Vulnrichment

Updated: 2026-07-21T16:06:59.911Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62415", "assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "state": "PUBLISHED", "assignerShortName": "Joomla", "dateReserved": "2026-07-14T05:16:10.070Z", "datePublished": "2026-07-21T09:19:19.754Z", "dateUpdated": "2026-07-23T15:01:08.350Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Membership Pro extension for Joomla", "vendor": "joomdonation.com", "versions": [{"status": "affected", "version": "1.0-4.6.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets."}], "value": "Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1188", "description": "CWE-1188: Initialization of a Resource with an Insecure Default", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "shortName": "Joomla", "dateUpdated": "2026-07-23T15:01:08.350Z"}, "references": [{"tags": ["product"], "url": "https://joomdonation.com/joomla-extensions/membership-pro-joomla-membership-subscription.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T16:08:00.980450Z", "id": "CVE-2026-62415", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T16:08:55.018Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-62415", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-21T16:08:00.980450Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T16:06:59.911Z"}}], "cna": {"title": "Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "joomdonation.com", "product": "Membership Pro extension for Joomla", "versions": [{"status": "affected", "version": "1.0-4.6.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://joomdonation.com/joomla-extensions/membership-pro-joomla-membership-subscription.html", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.", "supportingMedia": [{"type": "text/html", "value": "The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188: Initialization of a Resource with an Insecure Default"}]}], "providerMetadata": {"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "shortName": "Joomla", "dateUpdated": "2026-07-22T05:37:41.341Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62415", "state": "PUBLISHED", "dateUpdated": "2026-07-22T05:37:41.341Z", "dateReserved": "2026-07-14T05:16:10.070Z", "assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "datePublished": "2026-07-21T09:19:19.754Z", "assignerShortName": "Joomla"}, "dataVersion": "5.2"}