joomla! 5.2.6 and joomla! 4.4.13 released

Joomla: A flexible platform with a modular, powerful and SEO-friendly structure

Joomla is an open-source and powerful content management system (CMS) that, due to its flexibility and modular structure, allows you to create a variety of websites from personal blogs to large corporate portals.

Joomla's modular structure

This structure separates the core of Joomla from various components and extensions. This allows for :

• Extensibility: It is possible to add new features by installing extensions without making changes to the core.
• Customization: The design and layout of the website can be easily changed using templates and modules.
• Performance improvement: Only the required extensions are activated and additional load on the server is prevented.

The Importance of SEO in Joomla

Joomla provides a suitable platform for website SEO by providing several features :

• URL Structure: Ability to create friendly and optimized URLs for search engines.
• Metadata Management: Ability to specify meta tags (title, description, keywords) for each page.
• Responsiveness: Joomla templates are responsive and display correctly on different devices.
• SEO Plugins: Several plugins are available for advanced SEO that allow keyword analysis, content optimization, and sitemap creation.

With its modular structure and SEO features, Joomla is a good choice for websites that are looking for flexibility, scalability, and high rankings in search engines. However, SEO optimization in Joomla requires sufficient knowledge and experience in this field.

The Importance of Security Updates in Joomla

Joomla, as a popular content management system (CMS), is always exposed to various security threats. Joomla security updates, which are released by the development team, play a vital role in maintaining the security of websites based on this system. These updates often include fixing security vulnerabilities identified in Joomla core, extensions, and templates. Failure to apply these updates leaves the website vulnerable to hacker attacks, intrusion, data theft, and malware infection.

Furthermore, websites that are not updated regularly may face problems with performance, compatibility with new browsers, and search engine rankings.

Therefore, regular updates of Joomla core, extensions, and templates are an essential requirement to maintain the security, performance, and credibility of the website. Website administrators should regularly check for updates and apply them as soon as possible. Also, using reputable security plugins and creating a regular backup schedule can significantly improve the security of a Joomla website.

As I explained, on 08 April 2025, the Joomla Project announced the release of Joomla 5.2.6 and Joomla 4.4.13. These are security fixes for the Joomla 5.x and 4.x series. These releases deliver Joomla's high standards in web design, highlighting Joomla's values ​​of inclusiveness, simplicity, and security in a more powerful open source web platform.

Security Issues Fixed in Joomla 5.2.6 and Joomla 4.4.13

• Framework - SQL Injection Vulnerability in the quoteNameStr Method of the Database Package.
• Core - MFA Authentication Bypass.

SQL Injection Vulnerability in quoteNameStr Method

The Joomla development team has recently released a critical security patch to address an SQL injection vulnerability in the quoteNameStr method of the database package. This vulnerability, if exploited, could allow an attacker to inject malicious SQL statements into the database and take control of it.

The quoteNameStr method is responsible for protecting table and column names from special characters. Unfortunately, the flaw in this method allowed for the bypass of these protections. Attackers could exploit this weakness to extract, manipulate, or even delete sensitive data.

This vulnerability emphasizes the importance of immediately updating Joomla systems. All website administrators and Joomla developers are strongly advised to install the latest version of Joomla as soon as possible and use the updated database package. This action minimizes the risk of exploiting this vulnerability and compromising the security of the website.

The Joomla team recommends that its users always take the latest security updates seriously and to constantly monitor the system and apply new updates to maintain the security of their website.

Bypassing MFA Authentication

Multi-factor authentication (MFA) is designed to be a critical security layer in content management systems (CMS) such as Joomla, to protect user accounts from unauthorized access. Joomla multi-factor authentication (MFA) requires two or more different authentication factors to log in, typically including a password (something you know) and a one-time code (something you have). However, while MFA significantly increases the level of security, there are vulnerabilities that can allow this mechanism to be bypassed.

Bypassing MFA in Joomla means that an attacker is able to gain access to a user account without providing all of the required authentication factors. This can happen through a variety of methods, including :

• Coding vulnerabilities in the MFA plugin itself: There may be bugs in the plugin’s coding that allow an attacker to bypass the MFA verification process. These bugs can be caused by flaws in the authentication logic, improper session management, or improper input validation.
• Exploiting core Joomla vulnerabilities: If Joomla core has a security vulnerability, an attacker can use this vulnerability to bypass the MFA process. This can include things like SQL injection, cross-site scripting (XSS), or cross-site request forgery (CSRF).
• Social engineering attacks: An attacker can trick a user into providing them with their authentication information (such as a one-time code). This is especially common among users who are not aware of the importance of MFA.
• Physical access to the user's device: If an attacker has physical access to the mobile device or computer that the user uses to generate MFA codes, they can easily bypass MFA.

The consequences of bypassing MFA in Joomla can be very serious. With access to user accounts, an attacker can :

• Modify or delete content: Deface the website, publish false information, or delete important content.
• Steal information: Access sensitive user information, such as usernames, passwords, emails, and financial information.
• Install malware: Upload malicious code to the website and use it to distribute malware or carry out other attacks.
• Modify website settings: Change website settings to their advantage, such as redirecting traffic or accessing administrative sections.

To prevent MFA bypass in Joomla, the following measures are recommended :

• Regularly update Joomla and plugins: Make sure that Joomla and all plugins you use (especially MFA plugins) are updated to the latest available version. This allows security vulnerabilities to be identified and fixed.
• Use reputable MFA plugins: Use MFA plugins with a good track record and strong support.
• Educate users: Educate users about the importance of MFA and how to identify and prevent social engineering attacks.
• Restrict access: Restrict user access to administrative areas of your website and allow only essential people to access these areas.
• Monitor for unusual activity: Regularly monitor your website for unusual activity and take action if you see any suspicious activity.

MFA is a powerful tool for enhancing Joomla security, but it is not enough on its own. Combining MFA with other security measures, such as regular updates, user education, and ongoing monitoring, can significantly reduce the risk of MFA bypasses and their consequences.

   Joomla 5 is the latest main version. No new features will be added in Joomla 4 and it will only receive security updates until October 14, 2025.

Continued at source ...

source + download : joomla 5.2.6 and joomla 4.4.13

Author : asal

Comments (0)

Rated 0 out of 5 based on 0 voters

There are no comments posted here yet

Leave your comments

1. Posting comment as a guest. COM_KOMENT_LOGIN_LINK

Username

Password

Login to my account →

Name (Required)

Email (Required)

Website

Background

Rate this post:

Reset Rating

0 Characters

Attachments (0 / 3)

Share Your Location

Type the text presented in the image below

Cancel Submit Comment