Security
Phoca Cart patches critical unauthenticated SQL injection
Phoca Cart users should review their installed version after a published analysis identified a critical SQL injection in the Joomla extension’s public product filter.
mySites.guru published research into the flaw, which affects the front-end product filter and can be reached without authentication. The vulnerable code accepts product attribute and specification parameters and places them into SQL queries without adequate escaping. The issue is classified as CWE-89 and tracked as CVE-2026-74251, with a CVSS 4.0 score of 9.3 (Critical).
Phoca Cart 5.xis fixed in5.2.4; earlier releases are affected.Phoca Cart 6.xis fixed in6.1.7; earlier releases are affected.- The available
3.xand4.xbranches remain unpatched.
The research was based on code and release analysis, not a live attack, and does not report confirmed exploitation. Administrators should update to the appropriate fixed release immediately. Joomla 5 sites running Phoca Cart 6.x may need to install 6.1.7 manually because the extension updater may not offer it. Sites on Joomla 3 or 4 should migrate to a supported, fixed branch or remove the extension.
Originally reported by mySites.guru.