CVE-2026-75952: Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3

Severity: medium (CVSS 4.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-19 · updated 2026-08-26
Weakness: CWE-352

Description

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions (app install, demo-data wipe, cache/statistics archive, payment notification send, mobile push). Frontend CSRF needs a registered/listing-owner session; admin CSRF needs a backend admin session.

Affected products

cmsjunkie.com J-BusinessDirectory extension for Joomla: 1.0.0-6.2.2

References

https://www.cmsjunkie.com/

Get alerted when CVE-2026-75952 or the next vulnerability affects your stack