CVE-2026-102425: Balbooa Forms

Critical severity, CVSS 10.0. EPSS: 0.4% chance of exploitation in the next 30 days.

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.

Affected products

• Balbooa Forms: before 2.4.3.4 (fixed in 2.4.3.4)

Published 2026-09-29. Last modified 2026-10-06.