Security
DPCalendar SQL injection fixed in Joomla security update
Digital Peak has fixed a high-severity, unauthenticated SQL injection in its DPCalendar extension for Joomla, which could expose the site database to anonymous visitors.
mySites.guru published the research and reported the issue to Digital Peak before public disclosure. The vulnerability affects DPCalendar from 8.18.0 onward, across the Free, Pro and Business editions. It is tracked as CVE-2026-57831 and rated High, with a CVSS 4.0 score of 8.7.
The flaw was in the public events feed. An attacker could submit an untrusted author-filter value and use SQL injection to infer data from database tables without logging in. Potentially exposed information includes Joomla accounts and password hashes, configuration secrets and other stored site data. No exploitation in the wild is reported in the write-up, and mySites.guru did not publish a working proof of concept.
- Joomla 4.4.4 through 6.x: update to DPCalendar
10.11.2. - Joomla 3: update to
8.19.4.
Administrators should update immediately. A web application firewall may reduce exposure but is not a substitute for installing the vendor’s fix.
Originally reported by mySites.guru.