Critical RCE Flaw in Joomla Page Builder CK Triggers Patch Warning
Active Exploitation · 3 sources · Updated 4mo ago · First seen Jun 29, 2026
A critical vulnerability, CVE-2026-56290, affects the Joomla Page Builder CK extension before version 3.6.0 and allows unauthenticated arbitrary file upload. The flaw can let remote attackers upload executable files and achieve full remote code execution, and it has been assigned a CVSS 4.0 score of 10.0. Belgium’s Centre for Cybersecurity issued a warning urging organizations to patch immediately because exposed Joomla sites using the vulnerable extension could be compromised without authentication.
Advisories recommend upgrading Page Builder CK to 3.6.0 or later, restricting upload permissions, and validating allowed file types to reduce exposure. Related vulnerability reporting published at the same time also highlighted a separate critical web CMS plugin issue, CVE-2026-57331, in the WordPress Paid Videochat Turnkey Site plugin through 7.4.8, where an arbitrary file deletion flaw rated CVSS 9.9 was remediated in 7.4.9 or later, underscoring continued risk from insecure file-handling bugs in widely deployed content management extensions.
