Loading story…
A critical vulnerability tracked as CVE-2026-65883 affects Aimy Captcha-Less Form Guard for Joomla, enabling unauthenticated PHP object injection through a forged clfgd field in versions 18.0 through 20.0. The flaw stems from the plugin accepting attacker-controlled form data, base64-decoding and XOR-deobfuscating it, and passing the result to PHP unserialize() without integrity protection. The issue is classified as CWE-502 and carries a CVSS v4 rating consistent with network-exploitable, low-complexity attack conditions requiring no privileges or user interaction, with high impact on confidentiality, integrity, and availability.
VulnCheck reported that the bug can be chained to remote code execution as the web user on Joomla 3.9 through 5.2.1 by leveraging the Joomla core FormattedtextLogger gadget, and demonstrated exploitation through a public form flow that recovers the XOR keystream from known plaintext before submitting a crafted serialized object to drop a PHP webshell. Even where direct RCE is not reliable on newer Joomla builds, the vulnerability still allows PHP object injection and complete captcha bypass. Aimy Extensions released a fix in version 20.1, and exposed sites running earlier plugin versions remain at risk until updated.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for CVE-2026-65883 states that security@joomla.org received the report on July 29, 2026. The issue is a remote code execution vulnerability in the Aimy Captcha-Less Form Guard Joomla plugin caused by PHP object injection via a forged clfgd field.
Aimy Extensions fixed the PHP object injection issue in Aimy Captcha-Less Form Guard by releasing version 20.1. The vulnerable range was versions 18.0 through 20.0.
VulnCheck disclosed that CVE-2026-65883 is a critical unauthenticated PHP object injection flaw in Aimy Captcha-Less Form Guard that can be chained to remote code execution on Joomla 3.9 through 5.2.1 using the Joomla core FormattedtextLogger gadget. The disclosure included technical details showing how attackers could forge the clfgd token and achieve end-to-end exploitation via a public form flow.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
vulncheck.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, **`CVE-2026-56290`**, affects the Joomla **Page Builder CK** extension before version **3.6.0** and allows **unauthenticated arbitrary file upload**. The flaw can let remote attackers upload executable files and achieve **full remote code execution**, and it has been assigned a **CVSS 4.0 score of 10.0**. Belgium’s Centre for Cybersecurity issued a warning urging organizations to patch immediately because exposed Joomla sites using the vulnerable extension could be compromised without authentication. Advisories recommend upgrading **Page Builder CK** to **3.6.0 or later**, restricting upload permissions, and validating allowed file types to reduce exposure. Related vulnerability reporting published at the same time also highlighted a separate critical web CMS plugin issue, **`CVE-2026-57331`**, in the WordPress **Paid Videochat Turnkey Site** plugin through **7.4.8**, where an **arbitrary file deletion** flaw rated **CVSS 9.9** was remediated in **7.4.9** or later, underscoring continued risk from insecure file-handling bugs in widely deployed content management extensions.
Jul 1, 2026
CISA has added two Joomla extension vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation against **SP Page Builder** and **Page Builder CK**. The flaws, tracked as `CVE-2026-48908` and `CVE-2026-56290`, are unauthenticated arbitrary file upload bugs that allow attackers to place malicious files on exposed Joomla sites and achieve remote code execution. Security reporting says the vulnerabilities have been used to upload web shells, deploy PHP file-manager backdoors, and create hidden administrator accounts for persistence on compromised systems. Vendor fixes are available, including **SP Page Builder 6.6.2** for the zero-day issue, and defenders are being urged to patch immediately or temporarily disable the affected extensions and restrict public access to vulnerable upload endpoints until remediation is complete.
Jul 8, 2026
FortiGuard Labs reported ongoing in-the-wild exploitation of **CVE-2026-48908**, a critical `CVSS 10.0` unauthenticated remote code execution flaw in the JoomShaper **SP Page Builder** extension for Joomla. The bug stems from an unrestricted file upload in the `asset.uploadCustomIcon` functionality that lets attackers upload and execute arbitrary PHP files, enabling full server compromise. Public proof-of-concept exploit code is available, and the vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog after active abuse was confirmed. FortiGuard said exploitation has remained elevated, with **1,210 blocked attempts in 24 hours** and **15,626 over 7 days**, indicating sustained automated scanning of Internet-facing Joomla servers. The highest attack volumes were observed against organizations in **Poland, Turkey, Australia, and the United States**, with **Telecommunications/Carrier** and **Technology** among the most targeted sectors. Defenders were urged to upgrade to **SP Page Builder 6.6.2 or later**, restrict public access to Joomla administrative interfaces, block PHP execution in upload directories, and investigate for **web shells**, suspicious files, unauthorized administrator accounts, and other persistence because patching alone does not remove an existing compromise.
Jul 19, 2026