CVE-2026-21630: Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint
Published Apr 1, 2026
·Updated
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
Affected Software
3 affected components
Joomla Joomla Core
Joomla Joomla\!>=3.0.0<5.4.4
Joomla Joomla\!>=6.0.0<6.0.4
Event History
Apr 1, 2026
CVE Published
via MITRE·09:03 AM
Data Sourced
via MITRE·09:03 AM
DescriptionWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-21630?
CVE-2026-21630 has been classified as a critical vulnerability due to its potential for SQL injection.
2
How do I fix CVE-2026-21630?
To fix CVE-2026-21630, update your Joomla! installation to the latest version where the vulnerability is patched.
3
What are the potential impacts of CVE-2026-21630?
The potential impact of CVE-2026-21630 includes unauthorized access to database information through SQL injection.
4
Which versions of Joomla! are affected by CVE-2026-21630?
CVE-2026-21630 affects all Joomla! versions prior to the security fix released on March 2, 2026.
5
Is there a workaround for CVE-2026-21630?
Currently, there are no known effective workarounds for CVE-2026-21630, and updating is the recommended solution.