A severe security flaw has been uncovered in Balbooa Forms, a popular extension for Joomla websites. This vulnerability, identified as CVE-2026-102425, allows attackers to execute malicious code on affected websites without needing to log in. This type of attack is known as Unauthenticated Remote Code Execution (RCE) and poses a critical risk to the integrity and security of your website.<\/p>\n
The core of this issue lies within how Balbooa Forms handles PHP code defined by administrators for post-submission actions. Specifically, when a public form is set up to run custom PHP code and includes form-field shortcodes, the component improperly replaces these shortcodes with raw user-submitted values before executing the PHP. This oversight creates an opening for an attacker to inject harmful code, leading to complete control over the compromised server.<\/p>\n
Product:<\/strong> Balbooa Forms for Joomla!<\/p>\n Published:<\/strong> September 29, 2026<\/p>\n Severity:<\/strong> CRITICAL<\/p>\n Status:<\/strong> Analyzed<\/p>\n This vulnerability impacts Balbooa Forms for Joomla! versions prior to 2.4.3.4.<\/p>\n The vulnerability has been officially analyzed. This means the details have been confirmed and are available to the public, allowing vendors and users to take appropriate action.<\/p>\n CVE-2026-102425 has been assigned a CRITICAL<\/strong> severity rating, with a CVSS score of 10.0. This is the highest possible severity, indicating that the vulnerability is easy to exploit and can lead to complete compromise of the affected system without any user interaction. Immediate action is strongly recommended to prevent potential attacks.<\/p>\n To protect your Joomla website from this critical RCE vulnerability, it is imperative to update your Balbooa Forms extension immediately. The vendor, Balbooa.com, has released a fix in version 2.4.3.4 and later. If you are running an earlier version, you are at significant risk.<\/p>\n https:\/\/www.balbooa.com\/<\/p>\n","protected":false},"excerpt":{"rendered":" Understanding the Critical Threat to Balbooa Forms A severe security flaw has been uncovered in Balbooa Forms, a popular extension for Joomla websites. This vulnerability, identified as CVE-2026-102425,<\/p>\n","protected":false},"author":17,"featured_media":2649,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1191,870,980,887,695],"class_list":["post-4145","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-balbooa-forms","tag-forms","tag-joomla","tag-rce","tag-web-security"],"yoast_head":"\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n