Critical severity · published Jul 28, 2026
CVE-2026-65880
Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3
10.0
CVSS
0.8%
EPSS
No
On KEV
Description
Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Balbooa Forms component for Joomla · balbooa.com
1.0.0-2.4.2.1 · source: vendor
Affected product
BF
Balbooa Forms component for Joomla
balbooa.com
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-65880
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-65880
www.balbooa.com
https://www.balbooa.com/joomla-forms
More from Balbooa Forms component for Joomla
8.6
CVE-2025-49485
Extension - balbooa.com - SQL injection in Balbooa Forms component version 1.0.0 - 2.3.1.1 for Joomla