# CVE-2026-102428: OrdaSoft Joomla CCK unauthenticated SQL injection

Source: https://junglewise.ai/threats/cve-2026-102428-joomla-extension-ordasoft-com-unauthenticated-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-102428 · Severity: info · Published 2026-10-05

OrdaSoft Joomla CCK is a content management extension for Joomla websites that allows users to create custom content types. An unauthenticated attacker can inject malicious SQL code through the sort order parameter, potentially gaining unauthorized access to sensitive database information without authentication.

Vendors: [OrdaSoft](https://junglewise.ai/threats/vendors/ordasoft).

## Quick answers

**Is CVE-2026-102428 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102428 being exploited in the wild.

**How severe is CVE-2026-102428?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** OrdaSoft Joomla CCK before 8.3.16.

**Is there a fix for CVE-2026-102428?** Yes: fixed in 8.3.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102428 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102428?** Check whether you run OrdaSoft Joomla CCK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.3.16

## Technical details

SQL injection vulnerability in the order column parameter that accepts user input without proper validation or sanitization. The vulnerability is unauthenticated and exploitable over the network. An attacker can execute arbitrary SQL queries to read or modify database contents, and a fix is available in version 8.3.16 and later.

## Affected products

- OrdaSoft Joomla CCK before 8.3.16

## Timeline

- 2026-10-05: disclosed

## References

- [https://www.ordasoft.com/](https://www.ordasoft.com/)

## Related threats

- [OrdaSoft Joomla CCK unauthenticated remote code execution in uploader](https://junglewise.ai/threats/cve-2026-102427-joomla-extension-ordasoft-com-unauthenticated-remote-code)