If you received an email from me pointing you to this page, it is because your website appears to be running a vulnerable version of Page Builder CK (Joomlack’s com_pagebuilderck), a page-builder extension for the Joomla content management system. This page explains why that matters and what to do.

This notice concerns CVE-2026-77994, a critical (CVSS 9.3) SQL-injection vulnerability. In affected versions, a value stored in your page content is placed into a database query without the safeguard that keeps such values from changing the query’s meaning. That lets a remote attacker - with no login and no account on your site - read information out of your site’s database.

This is a different issue from the earlier Page Builder CK vulnerability (CVE-2026-56290, a file-upload flaw). Both affect the same extension; this one is a database read, not a site takeover.

Which versions are fixed - and which have no fix yet

Page Builder CK ships on separate release lines for each Joomla version. As of this writing, the fix for this issue has been released only on the Joomla 5/6 line.

If your site runs… Status of the fix What to do
Joomla 5 or 6 Fixed in 3.6.5 Update Page Builder CK to 3.6.5 or later
Joomla 4 No fixed build (latest is 3.4.11, still affected) Move to the Joomla 5/6 line (3.6.5), or remove the extension
Joomla 3 No fixed build (latest is 3.1.2, still affected) Move to the Joomla 5/6 line (3.6.5), or remove the extension

If you run Joomla 5 or 6, this is a straightforward update to 3.6.5 or later.

If you run Joomla 3 or 4, there is currently no patched Page Builder CK build for your Joomla line - the newest available versions on those lines still contain the flaw. Updating “to the latest” on your line will not fix it. Your realistic options are to move to the Joomla 5/6 release line (which means upgrading Joomla itself) or to remove the Page Builder CK extension. If neither is possible right away, treat placing your site behind a web application firewall as an interim measure, not a fix.

This is an extension flaw, not a Joomla core flaw. A fully up-to-date Joomla core does not protect you if the Page Builder CK extension itself is affected.

Is this message legitimate?

Yes. This is a good-faith, responsible-disclosure notice from an independent security researcher. I am not asking you for money, passwords, or access to your site, and I have not attempted to break into it, submit anything to it, or exploit anything.

All I did was look at publicly visible files that your website serves to every visitor (the same way your homepage is public) and note the version number that the Page Builder CK extension publishes in those files. Nothing about this check touches your data, your admin area, or any private part of your site.

If you would like to verify who I am, see the contact details at the bottom of this page and the About page.

Why this matters

Page Builder CK is a widely used drag-and-drop page builder for Joomla. In affected versions, content that Page Builder CK stores for a page is later used to build a database query when the page is displayed, without being safely separated from the query itself. An attacker who can influence that stored content - which, in affected versions, does not require an account - can make the query return data it should not, and read information out of your database. Depending on what your site stores, that can include user records, password hashes, and secret keys.

To be clear about the limits of this issue: it is a database read. It is not, by itself, remote code execution, and it does not by itself hand an attacker an administrator account or control of your server. I am telling you what it is and what it is not, because accuracy matters more than alarm.

If my email cited this issue, it means the version your site reports falls within the affected range. I did not test whether your particular site is exploitable or whether any data was actually read - only that it reports an affected version.

How to check your version

You do not have to take my word for which version you are running.

From the public manifest (no login needed): open yourdomain.com/administrator/components/com_pagebuilderck/pagebuilderck.xml in a browser. The <version> line is the version your Page Builder CK install reports, and this is the same public file I read.

From the admin area (if you have access):

  1. Log in to your Joomla administrator (usually at yourdomain.com/administrator).
  2. Go to System then Manage then Extensions (or Extensions then Manage, depending on your Joomla version).
  3. Search for Page Builder CK and note the installed version, and note which Joomla version you run (shown on the admin dashboard).

Compare both against the table above. Because the fix currently exists only on the Joomla 5/6 line, the version number alone does not tell you whether a fix is available to you - your Joomla line does.

How to fix it

If you run Joomla 5 or 6:

  1. Back up your site (files and database) first.
  2. In the Joomla admin, open Extensions then Manage then Update, click Find Updates, and install the Page Builder CK update if listed (it will offer 3.6.5 or later for the Joomla 5/6 line).
  3. If no update appears there, download the latest release from the vendor, Joomlack, at https://www.joomlack.fr/en/joomla-extensions/page-builder-ck and install it via Extensions then Install.
  4. Confirm the new version (3.6.5 or later) using the steps above.

If you run Joomla 3 or 4 (no patched build exists for your line):

  • The durable fix is to move to a Joomla version that has a patched Page Builder CK - i.e. upgrade to Joomla 5/6 and Page Builder CK 3.6.5 - which is a larger project and worth planning with your web developer.
  • If you cannot do that soon and do not actively need the extension, remove Page Builder CK.
  • As an interim measure only, a web application firewall may blunt opportunistic attempts, but it is not a substitute for removing or patching the affected code.

While you are in there, it is worth confirming that Joomla itself and your other extensions are up to date.

If you were on an affected version

This flaw is a database read, which leaves no obvious trace for you to find, so there is no file or account for you to hunt for the way there would be after a break-in. What is worth knowing is that updating (or removing the extension) closes the hole going forward but cannot un-read anything that may already have been read while an affected version was running.

As a reasonable precaution - not because I have any evidence your site was queried - if your site stores anything sensitive beyond published content (user accounts, customer data, integration secrets), it is worth rotating stored credentials and secret keys after you fix the issue, and reviewing your access logs for unusual query activity if you keep them.

I want to be clear: I have not examined your site for any of this, and I do not know whether any data was read. This guidance is here so you can decide for yourself.

I do not have a webmaster / I am stuck

If you are not the person who maintains the site, please forward this page to whoever does (your web developer, agency, or hosting provider). They will recognize the steps above quickly.

If you are maintaining the site yourself and get stuck, I am happy to help point you in the right direction at no cost. Reach out using the contact details below.

Contact

Evan Harris, Security Researcher

I reach out about issues like this purely to help operators secure their sites. If you would prefer not to be contacted again, just let me know and I will honor that.

References

Official advisories and tracking

Vendor (Joomlack)