Remote Code Execution in Aimy Captcha-Less Form Guard by aimy-extensions.com
CVE-2026-65883

10CRITICAL

Key Information:

Vendor

Aimy-extensions.com

Status
Aimy Captcha-less Form Guard Plugin For Joomla
Vendor
CVE Published:
29 July 2026

What is CVE-2026-65883?

The Aimy Captcha-Less Form Guard extension for Joomla is vulnerable to remote code execution due to a flaw allowing PHP object injection through a forged 'clfgd' field. This vulnerability poses a risk to Joomla installations using the affected versions 18.0, 19.0, and 20.0, allowing attackers to execute arbitrary PHP code on the server.

Affected Version(s)

Aimy Captcha-Less Form Guard plugin for Joomla 18.0-20.0

References

https://www.aimy-extensions.com/joomla/captcha-less-form-...
product

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.