CVE-2026-100752: Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-28 · updated 2026-10-27
Weakness: CWE-89

Description

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled order_field parameter, concatenated directly into an unquoted SQL clause with no allow-list of real column names and no cast.

Affected products

Ordasoft Real Estate Manager: before 6.7.9 — fixed in 6.7.9
ordasoft.com Real Estate Manager (Free) extension for Joomla: 1.0.0-6.7.8

How to fix

Upgrade to a fixed version: Ordasoft Real Estate Manager 6.7.9. Check the vendor advisory for mitigations.

References

https://www.ordasoft.com/

Get alerted when CVE-2026-100752 or the next vulnerability affects your stack