CVE-2026-97160

The UP plugin extension for Joomla versions 5.0.0 to 5.2.0 and 6.0.0 to 6.0.29 is vulnerable to authenticated, privileged PHP command injection, allowing attackers with valid credentials to execute arbitrary commands on the server. This critical vulnerability poses a significant risk to the integrity and confidentiality of affected systems. Joomla administrators and users of the UP plugin should prioritize immediate patching or mitigation efforts to safeguard their environments.