CVSS 10.0 (critical) ยท published 2026-09-29
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.
Affected products (NVD): balbooa forms
Fixed in (NVD): 2.4.3.4
Weakness: CWE-94
Source: NVD CVE-2026-102425
Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.