Critical severity · published Jun 20, 2026
CVE-2026-48909
Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4
9.5
CVSS
4.9%
EPSS
No
On KEV
Description
SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.9% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
SP LMS extension for Joomla · joomshaper.net
1.0.0-4.1.3 · source: vendor