CVE-2026-78072

Sexy Polling Reloaded, a polling component for Joomla by developer Jefferson49, contains an unauthenticated blind SQL injection flaw (CWE-89) in versions prior to 5.6.1. An attacker can trigger it by sending crafted input to the extension's publicly accessible polling functionality without any credentials; the flaw is blind, so results are inferred indirectly rather than returned directly in responses. Successful exploitation yields high-impact read access to the site's database per the CVSS 4.0 score, potentially exposing sensitive data such as user records or credentials depending on database contents. Any Joomla site running a version of the extension below 5.6.1 is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Update Sexy Polling Reloaded to version 5.6.1 or later. If upgrading is not immediately possible, restrict unauthenticated access to the component where feasible (for example via WAF or web-server rules) and review web server and database logs for unusual query patterns or slow responses, which are typical signs of blind SQL injection probing.