Vulnerable Joomla 3 extensions, when the fixed release no longer installs
The vendor fixed the extension, but only in the release for Joomla 4 or 5. On the client's Joomla 3 site the hole stays open, and the extension is needed.
The fix exists, but not for Joomla 3.
Phoca Download fixed an upload of executable files from the site (CVE-2026-57828, critical) only in 6.1.3, for Joomla 4 and 5. Regular Labs' Sourcerer runs {source} blocks that arrive from outside until 16.0.0, which needs Joomla 4 and PHP 8.2.
Configuration checks flag these as vulnerable extensions with no fix this site can install.
Two ways, depending on the case.
Official fix backported
For Phoca Download 3.2.1 to 3.2.3 we apply the line of the official fix to the Joomla 3 releases, with the same all-or-nothing check as the core.
Request block
For Sourcerer, where there is no fix to backport, Active Shield rejects requests with Sourcerer syntax, even when encoded several times. Tags saved in articles keep working.
Only where needed
A rule arms itself only if the site has a vulnerable release of the extension. We check again after every install, update or removal.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Can the platform send new rules?
No. The rules live in the agent's code. The platform can only set them to block, log only or off.
What does a blocked visitor see?
A 403 without details. The platform receives the rule, the part of the request and the IP without its last part, never the content. No log file stays on the site.
Goes well with
- Security patches for Joomla 3.10.12, after end of lifeThe 12 eLTS CVEs and 19 later fixes, on Joomla 3.10.12.
- Active Shield: official security fixes for end-of-life CMS releasesOfficial fixes for Joomla 3.10.12, PrestaShop 1.7.8.11 and Joomla 3 extensions.
- Traces of attacks on JCE, Helix and SP Page Builder on Joomla sitesAltered JCE profiles, code in Helix, SP Page Builder fonts uploaded by nobody.
- Vulnerability checks for plugins, themes and extensionsInstalled versions matched against Wordfence Intelligence and the Joomla Security Centre.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.