Page Builder CK CVE-2026-56290: Exploited Joomla Upload RCE
Only Joomla sites running Page Builder CK are at risk, but for them this is an emergency: an unauthenticated web-shell upload exploited within hours of the patch, with an incomplete first fix, so update to 3.6.5 or later and hunt for shells.
Must act: Anyone who runs or maintains Joomla sites with Joomlack's Page Builder CK (com_pagebuilderck), Light or Pro, including agencies looking after many client sites.
Can relax: Sites that do not use Joomla, and Joomla sites without Page Builder CK installed.
- Inventory every Joomla site and check whether Page Builder CK (com_pagebuilderck) is installed and at which version.
- Update to Page Builder CK 3.6.5 or later (3.6.7 is current); 3.6.0 closes only the unauthenticated hole.
- On Joomla 3 or 4, plan a move to Joomla 5 or 6 or remove the extension, because no back-port is documented as fixing the authenticated follow-up bug.