Mass-Assignment Vulnerability in K2 User Plugin for Joomla by Ecategory

CVE-2026-48943

What is CVE-2026-48943?

The K2 user plugin, version 2.24 and prior, has a mass-assignment vulnerability that allows registered Joomla users to manipulate their user profile data. By sending a specific post request with the parameter K2UserForm=1, users can modify values in the notes, image, and plugins columns of their records in the #__k2_users table, despite these fields being hidden in the frontend profile edit form. This flaw can potentially lead to unauthorized data exposure and compromise user account integrity.

References