Critical PHP Object Injection (CVE‑2026‑48909) in JoomShaper SP LMS Joomla Extension Enables Remote Code Execution
What Happened – A newly disclosed vulnerability (CVE‑2026‑48909) in the JoomShaper SP LMS extension (versions ≤ 4.1.3) allows an attacker to craft a malicious lmsOrders cookie that is unserialized by Joomla, triggering a PHP object‑injection chain. The chain can write an arbitrary PHP web‑shell to a writable directory, giving the attacker remote code execution on the host. The flaw is mitigated in JoomShaper SP LMS ≥ 4.1.4 and in Joomla ≥ 5.2.2, which patches the underlying gadget.
Why It Matters for Compliance & Audit Readiness
- SOC 2’s CC6.1 – Change Management and CC7.1 – System Operations require documented processes for patching third‑party components; this vulnerability shows the risk of lagging on extension updates.
- Continuous evidence of vendor‑component inventory and configuration baselines is essential to demonstrate due diligence during an audit.
- Mapping this control gap to a Control Mapping capability provides verifiable audit artifacts that prove the organization monitors and remediates software supply‑chain risks.
Who Is Affected – Organizations that run Joomla sites with the JoomShaper SP LMS extension (e.g., education portals, NGOs, small‑to‑mid‑size e‑commerce sites, and any web‑hosting providers offering Joomla‑based solutions).
Recommended Actions
- Upgrade JoomShaper SP LMS to ≥ 4.1.4 immediately.
- Patch Joomla to ≥ 5.2.2 or apply the vendor‑provided hotfix.
- Conduct an inventory of all installed Joomla extensions and verify each is on a supported, patched version.
- Integrate automated vulnerability scanning of web‑applications into your continuous compliance pipeline.
- Document the remediation steps and retain logs as audit evidence for SOC 2 controls.
Technical Notes – The exploit leverages PHP’s unserialize() on a base64‑encoded cookie, bypassing Joomla’s default cmd input filter by using hex‑encoded payloads. No public gadget chain leads to RCE on Joomla ≥ 5.2.2, but the extension remains exploitable on older Joomla installations. Source: Exploit‑DB 52617