CVE-2026-102782: Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OrdaSoft Simple Membershipto a version that resolves this vulnerability.Fixed in 7.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need authentication or any access-control bypass. The affected handler can be reached through the login-related task parameter.
How can I determine whether my site is affected?
Check whether the site uses the OrdaSoft Simple Membership extension and identify its installed version. Versions earlier than 7.4.0 are affected.
What is the likely security impact?
The issue is an SQL injection flaw with critical severity. The supplied CVSS vector indicates high impact to confidentiality, integrity, and availability.