Loading vulnerability…
CVE-2026-65883 is a critical unauthenticated deserialization vulnerability in Aimy Captcha-Less Form Guard for Joomla, affecting versions 18.0 through 20.0. The vulnerable code path processes an attacker-controlled form field, decodes and deobfuscates it, and passes the result to PHP unserialize() without signature validation, integrity protection, or class restrictions. Because the plugin exposes this mechanism on public forms, an attacker can forge the hidden token used by the plugin and supply crafted serialized data. On Joomla 3.9 through 5.2.1, the object injection can be chained through a Joomla core gadget in FormattedtextLogger to achieve remote code execution as the web server user. The same weakness also permits complete bypass of the plugin’s captcha-style anti-spam protection by forging acceptable token contents.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository is a small standalone Python exploit for CVE-2026-65883 affecting Aimy Captcha-Less Form Guard <= 20.0 on Joomla. Structure is minimal: README.md documents the vulnerability and usage, requirements.txt lists requests/urllib3, and cve_2026_65883.py is the main exploit implementation. The Python script is not part of a larger exploitation framework. Core capability: unauthenticated web RCE. The exploit targets Joomla pages that expose the vulnerable hidden clfgd field. It requests likely form endpoints, parses HTML to extract the base64 ciphertext and known plaintext components (captcha field ID and honeypot/trap field), then reconstructs enough of the repeating-key XOR keystream to encrypt a malicious serialized PHP object. The payload is a Joomla gadget chain centered on Joomla\CMS\Log\Logger\FormattedtextLogger, designed to trigger during object destruction and write a PHP webshell to disk. The shell executes arbitrary commands from HTTP parameter c and includes the AIMY-SHELL marker for verification. The script supports both single-target and mass-scanning modes, uses threading for concurrent scans, and includes detection, exploitation, and optional cleanup logic. Based on the visible code and README, it probes multiple common Joomla paths, attempts exploitation automatically, reports shell URL and command output, and is operational rather than a mere detector. The exploit depends on the target exposing a vulnerable form and allowing the Joomla/PHP process to write the shell file into a web-accessible location.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated PHP object injection vulnerability in the Aimy Captcha-Less Form Guard Joomla plugin that can be chained to remote code execution via a Joomla gadget chain on vulnerable core versions, and also enables captcha bypass.
An unauthenticated PHP object injection/deserialization vulnerability in Aimy Captcha-Less Form Guard that can lead to captcha bypass on all affected versions and remote code execution when chained with a suitable gadget, including Joomla core gadget chains on Joomla 3.9 through 5.2.1.
A remote code execution vulnerability in the Aimy Captcha-Less Form Guard plugin for Joomla caused by PHP object injection via a forged clfgd field, affecting versions 18.0 through 20.0.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.