Joomla Extensions, October 2026: OrdaSoft CCK (Fixed in 8.3.16) and TF Content, Two Unauthenticated 9.8 Flaws

On October 5, 2026, NVD published two new critical CVEs in Joomla extensions: OrdaSoft Joomla CCK and TF Content. Both are rated 9.8 and both are exploitable without authentication.

This follows straight on from the late-September roundup, which already covered an OrdaSoft flaw. The pattern holds: Joomla core is rarely the problem. Third-party extensions are, and they tend to get installed and forgotten.

OrdaSoft Joomla CCK — CVE-2026-102428

What the flaw does

The order column for records was user provided and not properly validated, leading to a SQL injection vector.

The parameter that picks the sort column comes from the request and isn't validated. It's a textbook SQL injection variant: prepared statements protect values, not column names or ORDER BY clauses, which have to be checked against an allowlist. Without that check, the attacker shapes the SQL query itself.

Why it matters

No account, no user interaction. SQL injection on a Joomla site potentially exposes the whole database: user accounts and password hashes, sessions, content. Depending on the SQL user's privileges it can extend to modifying data, hence the I:H in the vector.

Versions

NVD describes the flaw as affecting versions before 8.3.16. The published bound is 8.3.16, the first unaffected version according to the description. Check OrdaSoft's release notes to confirm it's the right version for your branch.

TF Content — CVE-2026-102780

What the flaw does

TF Content, published by TechFry (joomlafry.com), is a frontend content management extension. NVD describes a missing authorization check combined with mass assignment:

The extension unconditionally authorizes both creation and editing in its public RecordController.

Put simply: the public controller allows creating and editing without checking permissions, and saves submitted properties without filtering them through the configured form. A guest visitor can modify any TF Content record, including its publication status, access level and author.

Why it matters

The 9.8 has a simple explanation: a guest can rewrite the site's public content. Defacement, phishing or SEO spam pages served from your domain, restricted content exposed by changing its access level, content reassigned to other accounts. On a corporate or e-commerce site, that's an instant reputation incident.

Versions

NVD lists versions 2.9.0 through 2.9.4, with a published bound of 2.9.4. NVD gives no explicit fixed version: check TechFry's extension page for the release to install. If none is available, disable the extension.

Detection

For both extensions:

• Inventory installed extensions (System → Extensions) with their exact version. That's often where the surprise is.
• Web server logs: requests to the affected components with unusually long sort parameters or form bodies, or bursts from a single IP.
• SQL logs if enabled: repeated syntax errors, abnormally slow queries.
• TF Content records: recent changes with no known editorial action, status or access-level changes, inconsistent authors.
• Joomla accounts: recently created super users or administrators, unexplained password changes.

Mitigation

1. Update OrdaSoft Joomla CCK to 8.3.16 or later.
2. Update TF Content to the fixed release published by TechFry; failing that, disable the extension until one ships.
3. Uninstall unused extensions. A disabled extension is still code you have to maintain; a removed one isn't.
4. Put a WAF in front of the site if you can't patch right away, keeping in mind it's a stopgap.
5. If compromised: restore content from a clean backup, reset Joomla account passwords, rotate the database user's password and the secrets in configuration.php.

Why Continuous Monitoring of CMS Extensions Matters

On Joomla, the real attack surface is the extensions. There are many of them, maintained by vendors of every size, and their flaws arrive in waves. Two roundups in one week is not a coincidence.

With cveo.tech, register your sites and their extensions with exact versions, and get alerted whenever a critical CVE affects them.