CVE-2026-66915

CVSS 10.0 (critical) · published 2026-08-10

Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.

Weakness: CWE-94

Source: NVD CVE-2026-66915

References

• https://www.fabrikar.com/
• https://mysites.guru/blog/fabrik-unauthenticated-rce-calc-element/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.