CVE-2026-60030 | The Joomla extension Quix Page Builder Pro is vulnerable to … | CVSS 8.7 HIGH

Description

The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions.

Metadata

CVE ID: CVE-2026-60030
State: PUBLISHED
Assigner: Joomla
Reserved: 2026-07-08 05:31 UTC
Published: 2026-07-20 18:11 UTC
Last updated: 2026-07-21 05:35 UTC
Primary CWE: CWE-284
CWE-284 Improper Access Control
Vendor / Product: themexpert.com / Quix Page Builder Pro extension for Joomla
Sources: cve.org · NVD

Severity & Metrics

8.7 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
themexpert.com	Quix Page Builder Pro extension for Joomla	—	1.0-6.2.0

Weakness (CWE)

CWE	Source	Description
CWE-284	cna	CWE-284 Improper Access Control

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References (1)

https://www.themexpert.com/quix-pagebuilder