- Welcome to VirtueMart Forum.
VirtueMart Community Forum
News:
Looking for documentation? Take a look on our wiki
Recent posts
#21
3rd party extension / Re: Responsive Joomla 5 and J...
Last post by sirius - September 09, 2026, 22:31:53 PMHi Jumbo, I successfully installed the template update; I just did it after updating VirtueMart, which is why I was asking. That said, everything is fine—zero errors.
#22
Security (https) / Performance / SEO, SEF, URLs / Re: Critical unauthenticated R...
Last post by d0ublezer0 - September 09, 2026, 22:16:46 PMAnyone? Guys, there's a serious security issue that could allow anyone to hack a site running VM—it happened to me. Who on the dev team can I contact? Milbo isn't replying, and I don't know anyone else who's actually part of the team. Also, I think I picked the wrong forum section to ask this.
#23
Security (https) / Performance / SEO, SEF, URLs / Critical unauthenticated RCE i...
Last post by d0ublezer0 - September 08, 2026, 21:32:07 PMHi everyone,
I found a critical, unauthenticated remote code execution vulnerability in VirtueMart core — confirmed present in the current release (4.6.4 "Eagle owl"), affecting every up-to-date VirtueMart installation, not just outdated ones. A single unauthenticated GET request is enough, no login, no CSRF token.
I reported this privately to Milbo in late August specifically to avoid publishing a working exploit before a fix ships. It's now been over a week with no response.
Given the severity — this is being actively exploited in the wild, we lost a production site to it — I don't think it's responsible to keep sitting on it silently while waiting indefinitely. I'd like to escalate this to the VirtueMart core team directly rather than post exploit details here.
Could someone from the core team reach out so I can share the full technical write-up, proof of concept, and a suggested fix directly? I'm still not looking to go public with the details — just need this in front of someone who can act on it.
Thanks
I found a critical, unauthenticated remote code execution vulnerability in VirtueMart core — confirmed present in the current release (4.6.4 "Eagle owl"), affecting every up-to-date VirtueMart installation, not just outdated ones. A single unauthenticated GET request is enough, no login, no CSRF token.
I reported this privately to Milbo in late August specifically to avoid publishing a working exploit before a fix ships. It's now been over a week with no response.
Given the severity — this is being actively exploited in the wild, we lost a production site to it — I don't think it's responsible to keep sitting on it silently while waiting indefinitely. I'd like to escalate this to the VirtueMart core team directly rather than post exploit details here.
Could someone from the core team reach out so I can share the full technical write-up, proof of concept, and a suggested fix directly? I'm still not looking to go public with the details — just need this in front of someone who can act on it.
Thanks
#24
Virtuemart Development and bug reports / Re: After update to 4.8.2 cann...
Last post by piliop - September 07, 2026, 15:22:53 PMin administrator\components\com_virtuemart\models\media.php
under the line 405 that seems like this :
Add
also
after line 440 whitch seems like this :
replace the line
With
under the line 405 that seems like this :
Code Select
if(!is_array($oldIds)) $oldIds = array($oldIds);Add
Code Select
if(isset($data['ordering'], $data['active_media_id'])){
if(!isset($data['mediaordering']) || !is_array($data['mediaordering'])){
$data['mediaordering'] = array();
}
$data['mediaordering'][(int)$data['active_media_id']] = (int)$data['ordering'];
}also
after line 440 whitch seems like this :
Code Select
// Bind the media to the product, replace the line
Code Select
return $table->bindChecknStore($data);With
Code Select
$result = $table->bindChecknStore($data);
if(!empty($data['mediaordering']) && !empty($data['virtuemart_'.$type.'_id'])){
$db = JFactory::getDbo();
$relationTable = '#__virtuemart_'.$type.'_medias';
$entityId = (int)$data['virtuemart_'.$type.'_id'];
foreach($data['mediaordering'] as $mediaId => $ordering){
$query = $db->getQuery(true)
->update($db->quoteName($relationTable))
->set($db->quoteName('ordering').' = '.(int)$ordering)
->where($db->quoteName('virtuemart_'.$type.'_id').' = '.$entityId)
->where($db->quoteName('virtuemart_media_id').' = '.(int)$mediaId);
$db->setQuery($query)->execute();
}
}
return $result; #25
Virtuemart Development and bug reports / Re: After update to 4.8.2 cann...
Last post by jflash - September 07, 2026, 10:13:04 AMI am interested in this code fix 
#26
3rd party extension / Re: VP Neoteric - A Stunning ...
Last post by Jumbo! - September 07, 2026, 00:57:42 AMYou might not have noticed any compatibility issues so far, but that doesn't mean there aren't any. I would still recommend installing the update. It's always better to stay ahead of potential issues, even if they haven't surfaced yet.
#27
3rd party extension / Re: Responsive Joomla 5 and J...
Last post by Jumbo! - September 07, 2026, 00:56:54 AMYou might not have noticed any compatibility issues so far, but that doesn't mean there aren't any. I would still recommend installing the update. It's always better to stay ahead of potential issues, even if they haven't become apparent yet.
#28
Virtuemart Development and bug reports / Re: After update to 4.8.2 cann...
Last post by piliop - September 05, 2026, 14:03:58 PMI have found a temp solution in administrator/components/com_virtuemart/models/media.php
I added some code and now i am able to change the order by dragging the images.
if needed i can provide the fix code.
I added some code and now i am able to change the order by dragging the images.
if needed i can provide the fix code.
#29
Virtuemart Development and bug reports / After update to 4.8.2 cannot r...
Last post by piliop - September 05, 2026, 08:40:22 AMi have confirmed the problem in several different instances.
can anyone confirm it?
can anyone confirm it?
#30
Virtuemart Development and bug reports / [4.8.2] shopFunctionsF::render...
Last post by ptrouw - September 04, 2026, 15:12:28 PMOn Joomla 5, renderCaptcha() fires onDisplay on the application dispatcher instead of targeting the captcha plugin group. Every plugin listening to onDisplay responds, including the editor plugins, so the registration form renders an editor instead of a captcha.
components/com_virtuemart/helpers/shopfunctionsf.php, renderCaptcha(), line 1351 in build 11336:
if (JVM_VERSION < 5) {
vDispatcher::directTrigger('captcha', $reCaptchaName, 'onInit', array($id));
$output = vDispatcher::directTrigger('captcha', $reCaptchaName, 'onDisplay', array($reCaptchaName, $id, 'g-recaptcha required'));
} else {
$app = JFactory::getApplication();
$results = $app->triggerEvent('onInit', [$id]);
$output = $app->triggerEvent('onDisplay', [$reCaptchaName, $id, 'g-recaptcha required']);
}
The legacy branch passes the plugin group 'captcha' and the plugin name, so only that plugin is called. The Joomla 5 branch has no group, so the event reaches every onDisplay listener. onDisplay is also the event Joomla editors use to render.
The three captcha arguments land in the editor signature onDisplay($name, $content, $width, $height, $col, $row, ...):
arg 1 recaptcha_v3 -> $name
arg 2 dynamic_recaptcha_1 -> $content
arg 3 g-recaptcha required -> $width
Actual output on the registration form:
<textarea name="recaptcha_v3" id="recaptcha_v3" cols="20" rows="4"
style="width: g-recaptcha required; height: 500px;"
class="mce_editable wf-editor">dynamic_recaptcha_1</textarea>
cols="20" rows="4" are the editor defaults for the arguments VirtueMart does not pass.
Side effect: the stray editor instance requests its own language file and the editor-api ES module, which produces a 403, a MIME type error and an unresolved module specifier in the browser console. Those disappear once the event is targeted correctly.
To reproduce:
1. Install any captcha plugin and select it under Global Configuration > Site > Default Captcha (Joomla 5 ships none, we use reCAPTCHA v3 by SharkyKZ 1.3.1)
2. VirtueMart > Configuration > Shopfront, enable the captcha on registration
3. Open the user registration form as a guest
Expected: the captcha. Actual: an editor containing the literal text dynamic_recaptcha_1.
Switching the default editor between TinyMCE, JCE and None changes the markup each time, which confirms the editor group is receiving the event rather than one specific editor being at fault.
Suggested fix, using the Joomla 5 captcha API so only the selected plugin is called:
} else {
if ($reCaptchaName === '') {
$output = '';
} else {
$captcha = \Joomla\CMS\Captcha\Captcha::getInstance($reCaptchaName);
$captcha->initialise($id);
$output = $captcha->display($reCaptchaName, $id, 'g-recaptcha required');
}
}
The surrounding try/catch and the is_string($output) branch below already handle this return value, so nothing else needs to change.
One related note: checkCaptcha() a few lines down uses vDispatcher::trigger('onCheckAnswer', ...), which is also a broadcast. Nothing outside the captcha group listens to that event, so it causes no collision, but it does mean every enabled captcha plugin validates the answer.
components/com_virtuemart/helpers/shopfunctionsf.php, renderCaptcha(), line 1351 in build 11336:
if (JVM_VERSION < 5) {
vDispatcher::directTrigger('captcha', $reCaptchaName, 'onInit', array($id));
$output = vDispatcher::directTrigger('captcha', $reCaptchaName, 'onDisplay', array($reCaptchaName, $id, 'g-recaptcha required'));
} else {
$app = JFactory::getApplication();
$results = $app->triggerEvent('onInit', [$id]);
$output = $app->triggerEvent('onDisplay', [$reCaptchaName, $id, 'g-recaptcha required']);
}
The legacy branch passes the plugin group 'captcha' and the plugin name, so only that plugin is called. The Joomla 5 branch has no group, so the event reaches every onDisplay listener. onDisplay is also the event Joomla editors use to render.
The three captcha arguments land in the editor signature onDisplay($name, $content, $width, $height, $col, $row, ...):
arg 1 recaptcha_v3 -> $name
arg 2 dynamic_recaptcha_1 -> $content
arg 3 g-recaptcha required -> $width
Actual output on the registration form:
<textarea name="recaptcha_v3" id="recaptcha_v3" cols="20" rows="4"
style="width: g-recaptcha required; height: 500px;"
class="mce_editable wf-editor">dynamic_recaptcha_1</textarea>
cols="20" rows="4" are the editor defaults for the arguments VirtueMart does not pass.
Side effect: the stray editor instance requests its own language file and the editor-api ES module, which produces a 403, a MIME type error and an unresolved module specifier in the browser console. Those disappear once the event is targeted correctly.
To reproduce:
1. Install any captcha plugin and select it under Global Configuration > Site > Default Captcha (Joomla 5 ships none, we use reCAPTCHA v3 by SharkyKZ 1.3.1)
2. VirtueMart > Configuration > Shopfront, enable the captcha on registration
3. Open the user registration form as a guest
Expected: the captcha. Actual: an editor containing the literal text dynamic_recaptcha_1.
Switching the default editor between TinyMCE, JCE and None changes the markup each time, which confirms the editor group is receiving the event rather than one specific editor being at fault.
Suggested fix, using the Joomla 5 captcha API so only the selected plugin is called:
} else {
if ($reCaptchaName === '') {
$output = '';
} else {
$captcha = \Joomla\CMS\Captcha\Captcha::getInstance($reCaptchaName);
$captcha->initialise($id);
$output = $captcha->display($reCaptchaName, $id, 'g-recaptcha required');
}
}
The surrounding try/catch and the is_string($output) branch below already handle this return value, so nothing else needs to change.
One related note: checkCaptcha() a few lines down uses vDispatcher::trigger('onCheckAnswer', ...), which is also a broadcast. Nothing outside the captcha group listens to that event, so it causes no collision, but it does mean every enabled captcha plugin validates the answer.