CVE-2026-67364
CriticalCVSS 10.0Summary
Critical vulnerability (CVSS 9.8) in Joomla extension Balbooa Forms versions prior to 2.4.3.2. Allows an unauthenticated attacker to inject and execute arbitrary PHP code on the server via a URL parameter in a shortcode, when the form has a custom PHP handler configured.
Risk Assessment
Risk includes full server takeover, data theft, content modification, and further attacks. The attack can be performed remotely without authentication if conditions are met.
Recommendation
Immediately update Balbooa Forms to version 2.4.3.2 or later. If update is not possible, disable custom PHP handlers and add reCAPTCHA to submit buttons.
Original NVD description (English source)
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.