EXPOSURES › CVE-2026-102425
CVE-2026-102425
CRITICALUnauthenticated remote code execution in Balbooa Forms allows attackers to execute arbitrary PHP code via shortcode injection.
Balbooa Forms < 2.4.3.4 executes administrator-defined PHP code after public form submissions, replacing shortcodes with raw visitor input before eval(). This enables unauthenticated RCE if a public form uses the PHP-after-submission action and interpolates an attacker-controlled shortcode into a double-quoted PHP string. DIB orgs must patch immediately, restrict PHP execution on public-facing forms, and audit third-party extensions for similar eval() vulnerabilities.
Shame score — Unauthenticated RCE via eval() in a public-facing extension is a severe, avoidable failure that directly enables arbitrary code execution without authentication.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.