CVE-2026-78070

The DP Calendar extension for Joomla versions 5.5.0 to 10.11.2 is vulnerable to an authenticated, privileged blind SQL injection that can be exploited when saving an article with a content plugin, requiring users to have update permissions. Successful exploitation could allow attackers to manipulate the database, potentially leading to unauthorized data access or modification. Joomla administrators and users of the affected extension should prioritize applying updates to mitigate this vulnerability.