Alex Joseph
Understanding the lomart UP Plugin Vulnerability
A significant security flaw has been identified in the lomart UP plugin extension for Joomla, a popular content management system. This vulnerability, tracked as CVE-2026-97160, allows an attacker to inject and execute arbitrary PHP commands. If exploited, this could give an attacker control over the affected Joomla website.
The good news is that this attack requires the attacker to be authenticated and have privileged access to your Joomla site. However, the potential impact of such an attack is severe, emphasizing the need for immediate action for users of the affected versions.
CVE Details
Product Name: Joomla Extension – lomart.fr – UP plugin extension
CVE ID: CVE-2026-97160
Published: September 26, 2026
Last Modified: October 20, 2026
Status: Analyzed
Affected Products
The PHP command injection vulnerability specifically impacts the following versions of the lomart UP plugin extension for Joomla:
- Versions 5.0.0 through 5.2.0
- Versions 6.0.0 through 6.0.29
If your Joomla site uses any of these versions of the lomart UP plugin, it is susceptible to this vulnerability.
Current Status
As of October 20, 2026, this vulnerability has been officially analyzed. This means that the details of the flaw have been confirmed and are publicly known. The developer, lomart.fr, has likely released updates to address this issue.
Severity Level
This vulnerability is rated as HIGH severity, with a CVSS score of 8.8. A High severity rating indicates that exploiting this flaw could lead to significant damage. In this case, an attacker with authenticated, privileged access could execute malicious PHP commands, potentially compromising your entire Joomla site, stealing sensitive data, or defacing your website. This score underscores the critical need for administrators to address this vulnerability promptly.
Possible Solutions
The most crucial step to protect your Joomla website from CVE-2026-97160 is to update your lomart UP plugin extension immediately. While the specific patch version isn’t explicitly detailed in the public description, updating to the latest stable version of the lomart UP plugin is always recommended as it typically includes security fixes for known vulnerabilities. Review the official lomart.fr website or your Joomla administrator panel for available updates.
Always ensure your Joomla core and all installed extensions are kept up-to-date to maintain a strong security posture. Regular backups are also vital to ensure you can recover your site in case of an unforeseen issue.
For more insights into web security best practices, explore our other articles on plugin vulnerabilities.
References
https://up.lomart.fr/
