What the vulnerability does
01Description
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.
Explanation of Vulnerability in Simple Terms
02Summary
The Balbooa Forms extension for Joomla contains a code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code on the site. The vulnerability exists in versions 1.0.0 through 2.4.3.1 and requires no user interaction. An attacker can exploit this remotely over the network to gain full control of the Joomla installation.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site and take complete control of the Joomla installation.
Potential impact on your site
04Site Impact
An attacker can read, modify, or delete all site data, create admin accounts, or use the site to attack other systems.
Conditions required to exploit
05Prerequisites
None. The vulnerability is exploitable remotely without authentication or user interaction.
Key dates
06Disclosure timeline
August 19, 2026
CVE published
August 21, 2026
Record updated
