Joomla UP plugin RCE, patch now (CVE-2026-97163) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-97163 is a critical unauthenticated remote code installation flaw in the Joomla UP plugin (lomart.fr) versions 5.0.0-5.2.0 and 6.0.0-6.0.29 that lets any network attacker plant and run arbitrary code on the site. Treat every unpatched instance as compromised; apply the vendor patch or disable the extension immediately.

Overview

CVE-2026-97163 affects the UP extension for Joomla, distributed by lomart.fr. The flaw carries a CVSS score of 10.0, the maximum. The attack vector is network, complexity is low, and it requires no privileges and no user interaction. In plain terms: an attacker who can reach the site over HTTP can install and execute code without any account, any login, or any trick that depends on a victim clicking something.

The affected version ranges are 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. Any Joomla site running a UP plugin in those ranges is exposed the moment it is reachable on the internet.

Impact

Because the plugin accepts code installation without authentication, the practical outcome is full compromise of the Joomla installation. An attacker can drop a web shell, deface the site, harvest administrator credentials, pivot into the hosting account, or use the server as a beachhead for lateral movement. On shared hosting, that can expose neighboring tenants. On a site handling customer data, it is a breach waiting to be reported, and such incidents typically surface through breach reports.

Nothing in the CVSS vector suggests an attacker needs a valid session, a crafted file upload from a logged-in user, or social engineering. The barrier to entry is a working HTTP request. That is why this is rated critical rather than high.

Remediation

The UP plugin has a patched release, and the fix is the priority action:

1. Update the UP extension to a version above 6.0.29 (or above 5.2.0 on the 5.x line if you are pinned there). Confirm the patched build with the vendor at lomart.fr.
2. If you cannot update immediately, disable or uninstall the UP plugin. An extension that is not loaded cannot be abused.
3. Assume compromise on any site that was exposed before patching. Check for unexpected files under Joomla’s webroot, review administrator accounts, and rotate Joomla admin passwords, database credentials, and any secrets stored in configuration.php.
4. Add a web application firewall rule blocking unauthenticated requests to the plugin’s endpoints as a stopgap, not a substitute for patching.

Track vendor follow-ups and related coverage through security news.

Security Insight

Joomla extension vulnerabilities keep repeating a familiar pattern: a third-party plugin, maintained outside the core project, ships a remote code path with no authentication check. The Joomla core team cannot patch what it does not ship, so site owners carry the operational burden of inventorying every extension, tracking its upstream maintainer, and acting faster than the core update cycle. A CVSS 10.0 with a public proof-of-concept in a low-profile commercial plugin is exactly the case where extension sprawl becomes a liability. The lesson for defenders is that the attack surface of a CMS is rarely the CMS itself; it is the long tail of add-ons that nobody audits until an advisory like this one lands.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs