CVE-2026-62415
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Joomla extension Membership Pro (joomdonation.com) prior to version 4.6.2 by default allowed unauthenticated users to upload media assets. This is an insecure default configuration.
Risk Assessment
The organization risks that unauthenticated attackers can upload arbitrary media files to the server, potentially leading to disk space exhaustion or, in the case of executable files, remote code execution.
Recommendation
Update the Membership Pro extension to version 4.6.2 or later. Review and configure file upload permissions.
Original NVD description (English source)
Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.