CVE-2026-67364: Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla Extension - balbooa.com - Balbooa Formsto a version that resolves this vulnerability.Fixed in 2.4.3.2 - Configuration
Disable the optional custom-PHP post-submission handler (which is executed via eval()) so unescaped shortcode/URL parameter injection cannot lead to server-side PHP execution.
Balbooa Forms custom-PHP handler / post-submission handler execution = disabled - Configuration
Enable reCAPTCHA on the form submit button to prevent unauthenticated exploitation paths described as requiring no reCAPTCHA on submit.
Balbooa Forms submit button reCAPTCHA = enabled
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
A deployment is exposed when it uses Balbooa Forms earlier than 2.4.3.2 and has a form with a custom-PHP post-submission handler configured that references the [URL parameter = X] shortcode. The form's submit button must also have no reCAPTCHA enabled.
What does an attacker need to exploit this issue?
The attacker needs network access to the affected form endpoint and a way to supply a query-parameter value used by the form's URL-parameter shortcode. No authentication or user interaction is required; the required CSRF token can be obtained anonymously through a separate task.
Are forms without custom PHP handlers affected?
The described exploitation path requires the optional custom-PHP post-submission handler and a reference to the URL-parameter shortcode. Forms without that configured handler, or handlers that do not reference the shortcode, do not meet the stated exploitability conditions.
What can be done if upgrading is not immediately possible?
Disable custom-PHP post-submission handlers that reference the [URL parameter = X] shortcode, or remove those shortcode references. Enabling reCAPTCHA on affected form submit buttons also removes one of the stated exploitability requirements.