Unauthenticated Remote Code Execution in Balbooa Forms Joomla Extension by Balbooa
CVE-2026-65880

10CRITICAL

Key Information:

Vendor

Balbooa.com

Status
Balbooa Forms Component For Joomla
Vendor
CVE Published:
28 July 2026

What is CVE-2026-65880?

The Balbooa Forms Joomla extension contains a security flaw in its form processing logic, specifically affecting versions earlier than 2.4.3. This vulnerability allows unauthenticated users to execute arbitrary code through manipulated forms that utilize a signature field. As a result, attackers can exploit this weakness to potentially compromise the integrity of the affected system and gain unauthorized access.

Affected Version(s)

Balbooa Forms component for Joomla 1.0.0-2.4.2.1

References

https://www.balbooa.com/joomla-forms
product

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.