CVE-2018-11325: Joomla!

Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days.

An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or navigating to a previous install step, and display the plaintext password for the administrator account at the confirmation screen.

Affected products

• Joomla! Joomla!: before 3.8.8 (fixed in 3.8.8)

Published 2018-05-22. Last modified 2026-06-17.