External risk intelligence

Joomla Balbooa Forms Unauthenticated PHP Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-67364

The vulnerability affects a Joomla extension used to create forms on websites. As public-facing web forms are commonly deployed to collect user input directly from the internet, the vulnerable component is frequently reachable by remote, unauthenticated users in standard web application environments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in a popular Joomla extension that allows users to build forms. The issue stems from how the extension processes form submissions, enabling an unauthenticated attacker to inject and execute arbitrary PHP code on the server. This could lead to a complete compromise of the affected website.

Unauthenticated attackers can run custom code on servers.
This affects websites using specific form-building features.
Confirm if this form feature is enabled and unpatched.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by crafting a malicious request to a Joomla website using a vulnerable form builder. If the form has a custom PHP handler configured and lacks reCAPTCHA, the attacker can inject arbitrary PHP code. This PHP code is executed on the server because a specific shortcode is not properly escaped, allowing the attacker to gain control.

No authentication is required.
User submits a specially crafted form.
Allows arbitrary remote code execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could inject and execute arbitrary PHP code on the server when a Joomla website uses a specific form feature with a custom PHP handler and no reCAPTCHA. This could impact the server's behavior and any data it processes or stores.

Server-side code execution.
Exploits custom PHP handler via shortcode.
Compromise of server integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Balbooa Forms allows unauthenticated PHP code injection through a custom-PHP post-submission handler. Website owners or administrators responsible for managing Joomla extensions and their configurations are likely to address this issue. The first practical step involves identifying all instances of the affected Balbooa Forms version, confirming if the custom-PHP handler with the vulnerable shortcode is configured and exposed externally, and then assessing the business criticality of the affected forms to prioritize remediation.

Identify affected forms and owners.
Verify custom-PHP handler configuration and reachability.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Balbooa Forms extension for Joomla?

Balbooa Forms is a popular plugin for the Joomla content management system designed to let site owners build custom data-entry forms. It offers advanced features like custom PHP post-submission handlers, which allow developers to write specialized code that runs whenever a visitor submits a form. Because it acts as a bridge between user input and server-side logic, it is a critical component for websites that collect information directly from their audience.

What does PHP code injection mean in CVE-2026-67364?

This vulnerability is classified as CWE-94, which refers to improper control of generation of code. In this specific case, the extension fails to sanitize inputs before passing them to a PHP eval() function. This allows an attacker to inject and execute their own unauthorized commands directly on the server, essentially tricking the website into running malicious instructions as if they were part of the intended form-processing logic.

How is this vulnerability triggered?

An attacker triggers this by sending a crafted request to a form that utilizes the custom-PHP post-submission handler and references the vulnerable shortcode. The bug does not trigger if the form-builder's custom-PHP handler feature is disabled, or if the form is properly protected by reCAPTCHA, which forces a human-verification step that blocks automated exploitation attempts.

Is my Joomla site at risk from this vulnerability?

If you use Balbooa Forms, Halo Surface Signal identifies this as a likely risk because web forms are, by nature, public-facing and reachable by remote users over the internet. Since this flaw does not require authentication to exploit, any internet-accessible form with the vulnerable handler configuration enabled is exposed. You should consider any form exposed to the public internet as a potential entry point for an attacker.

When should I take action for CVE-2026-67364?

You should act immediately by auditing your Joomla installation to identify all forms using the affected version of the extension. Verify which of these forms have the custom-PHP post-submission handler enabled, as these are the primary targets. Once identified, prioritize these forms for updates or configuration changes to neutralize the risk, starting with those that are most accessible to the public.

References

www.balbooa.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.