Vulnerability · Published Jun 25, 2026 · Assigned by Joomla

CVE-2026-48943Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26

Medium 6.5

In plain English

A medium-severity security flaw in K2 extension for Joomla from getk2.org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 76.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.

Affected products (as reported)

Vendor	Product	Versions
getk2.org	K2 extension for Joomla	1.0-2.26

Weakness: CWE-915 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://www.getk2.org/ product