Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-66915: Joomla Fabrik Extension < 4.6.7 Allows Unauthenticated Code Execution
CVE-2026-66915 · published 25 days ago
Summary
The Fabrik extension for Joomla, available from fabrikar.com, has a vulnerability that allows an attacker to run malicious code without needing a login. This could potentially allow an attacker to access or modify sensitive data. Update the Fabrik extension to version 4.6.7 or later to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fabrikar.com | fabrik extension for joomla |
1.0.0-4.6.6 1.0.0-4.6.8 1.0.0-4.7.1 |
Original advisory text
Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.
Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.
Severity
10.0
Critical
CVSS 4.0: 10.0 (NVD)
Exploitation
EPSS <1%
Type
CWE-94Code Injection
Timeline
Published10 Aug 2026
Updated3 Sep 2026
First seen10 Aug 2026
Monitor software like this
Free during beta