Summary
CVE-2026-78072 is an unauthenticated blind SQL injection vulnerability in the Sexy Polling Reloaded extension for Joomla, developed by Jefferson49. The flaw allows a remote, unauthenticated attacker to send crafted input that is improperly neutralized before being used in a SQL command, enabling data exfiltration from the underlying database. The issue carries a HIGH severity rating with a base score of 8.7.
Technical details
- Root cause: Improper neutralization of special elements used in a SQL command (CWE-89), allowing attacker-controlled input to alter backend SQL query logic.
- Trigger conditions: No authentication or user interaction is required to exploit the vulnerability.
- Attack vector: Network-based; the injection is blind, meaning exploitation relies on inferential techniques (e.g., timing or boolean responses) rather than direct output of query results.
- Impact: Successful exploitation impacts confidentiality of data stored in the site’s database, with no direct impact on integrity or availability per the scored vector.
Affected software
- Sexy Polling Reloaded Joomla extension (Jefferson49), versions 1.0.0 through 5.6.0.
- Fixed in version 5.6.1.
Severity
CVSS v4.0 Base Score: 8.7 (High)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: Upgrade Sexy Polling Reloaded to version 5.6.1 or later, where the vulnerability is fixed.
- If immediate patching is not possible: Restrict or disable public access to the polling component/module until the update can be applied, and monitor web server and database logs for anomalous or repeated requests targeting the polling functionality.

