TI-2026-69008 Aliases CVE-2026-102781 GHSA-wf6m-88qg-rp6j

Unauthenticated Destructive CRUD in OrdaSoft Touch Slider Joomla Extension

LOW 36CWE-284Published 2026-10-07 · Updated 2026-10-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

OrdaSoft Touch Slider, a Joomla extension, has an improper access control flaw (CWE-284) in modOsTouchSliderHelper::getAjax(), reached through Joomla's core com_ajax dispatcher. The handler performs no user authentication, authorisation or CSRF token check, so unauthenticated requests reach every data-management operation. An unauthenticated GET can delete slider images by guessing sequential IDs, and an unauthenticated multipart upload of a zip file can replace the contents of the #__os_touch_slider and #__os_touch_slider_text tables site-wide. Versions before 5.4.6 are affected; the CVSS 4.0 base score is 6.9 (MEDIUM).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s core com_ajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser(), authorise(), or a CSRF token check exists anywhere in the handler. Two confirmed impact paths: an unauthenticated GET deletes any slider image by guessable sequential IDs, and an unauthenticated multipart upload with a zip file renames and replaces the entire #__os_touch_slider/#__os_touch_slider_text tables site-wide with attacker-supplied content, with no task parameter even required for the second path.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00239 15th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ordasoft.com	Touch Slider extension for Joomla	1.0.0-5.4.5	—	No fix listed	CNA

Touch Slider extension for Joomla Vendorordasoft.com Affected 1.0.0-5.4.5 Fixed in — No fix listed CNA

Remediation

Update the Touch Slider extension to version 5.4.6 or later, which fixes the issue. The vendor has not listed a fix in the affected version range, so check the vendor advisory for the patched release.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-07 Threatist record created from CVE-2026-102781
2026-10-07 Alias added: GHSA-wf6m-88qg-rp6j
2026-10-07 CISA SSVC decision points changed
2026-10-07 Priority changed: MEDIUM → LOW

References

Other 1

https://www.ordasoft.com/

TI-2026-65395 Unrestricted file upload in ordasoft.com OrdaSoft Joomla CCK CVSS 4.0CRITICAL 10.0
TI-2026-69009 SQL injection in OrdaSoft Simple Membership for Joomla CVSS 4.0CRITICAL 9.3
TI-2026-67746 Unauthenticated SQL injection in OrdaSoft Joomla CCK CVSS 4.0CRITICAL 9.3
TI-2026-65135 SQL injection in ordasoft.com Book Library extension for Joomla CVSS 4.0CRITICAL 9.3
TI-2026-65133 SQL injection in ordasoft.com Vehicle Manager extension for Joomla CVSS 4.0CRITICAL 9.3
TI-2026-64893 SQL injection in ordasoft.com Real Estate Manager extension for Joomla CVSS 4.0CRITICAL 9.3

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences