Vulnerability · Published Jul 17, 2026 · Assigned by Joomla
CVE-2026-60024Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0
Critical 9.8
In plain English
A critical-severity security flaw in Events Booking extension for Joomla from joomdonation.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 54.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| joomdonation.com | Events Booking extension for Joomla | 1.0-5.8.0 |
Weakness: CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H