The Joomla Project has released version 3.6.5 of the CMS that addresses three security bugs. One vulnerability allows attackers to change usernames and passwords. Another allows for changing the password of other accounts. Updating to version 3.6.4.4 is a must in these conditions, as webmasters could find their sites part of SEO spam or DDoS botnets. The flaws were discovered at the end of October and also allowed attackers to register accounts and elevate themselves to admin user groups.
Source: https://www.bleepingcomputer.com/news/security/vulnerability-in-joomla-allows-attackers-to-reset-passwords-and-take-over-sites/