Four Joomla extension flaws: Balbooa Forms 2.4.1 is not enough (CVE-2026-65880)

On July 28, 2026, a new vulnerability was published in Balbooa Forms, the form-building extension for the Joomla CMS: CVE-2026-65880 allows unauthenticated code execution on the server. Severity is a maximum 10.0 on CVSS 4.0. It only applies to sites whose forms include a Signature field.

If you read this article earlier, we owe you a correction. We told you to update to 2.4.1 in July. That does not protect you from this one. Per the vendor's notice, everything up to and including 2.4.2.1 is affected — 2.4.1 and 2.4.2 included. Only 2.4.3 is safe. Sites that patched to 2.4.1 in the July 9 rush and stopped there are exposed again.

This is the second flaw of this magnitude in Balbooa Forms in July alone, and the same vendor's page-builder extension, Balbooa Gridbox, has its own issue. This article now covers three Balbooa flaws and one iCagenda flaw — four in total. The two previously reported (CVE-2026-48939 in iCagenda and CVE-2026-56291 in Balbooa Forms) are already being exploited and are listed in CISA's catalogue of vulnerabilities confirmed under attack (KEV). If you run any of these, update and then check whether you have already been compromised.

CVE-2026-65880: unauthenticated code execution through a Signature field

This is the new one. On July 28 the vendor published a notice titled "Forms Signature Field Security Release" and shipped 2.4.3 the same day. Balbooa rates it Critical.

It applies only where a form contains a Signature field — the input that lets a visitor draw a handwritten signature with a mouse or finger, added in Balbooa Forms 2.1.3 and used for online consent forms and applications. If none of your forms use one, this particular flaw does not affect you.

The defect is in how the submitted signature is processed. A drawn signature arrives as an image encoded into a string, and the routine that decoded that string did so unsafely. The vendor describes the fix as "enforcing an explicit server-side decoding method and strengthening validation of structured form input." It is classified CWE-94, code injection — crafted data ends up interpreted as instructions. No login is required.

This is a different flaw from CVE-2026-56291, published on July 9. That one was an unrestricted file upload (CWE-434) that let an attacker drop a PHP file directly. This one goes through signature processing, and the affected version ranges differ. The vendor's own notice lists them as separate entries.

How this was found is worth noting. The vendor credits "BA Forms customers who responsibly reported suspicious activity," and separately advises checking site files "for any unexpected or suspicious PHP files." That reads like reports from sites where something was already happening, not a laboratory finding. That said, the Joomla CNA did not mark this record as exploited (it did for the two earlier flaws), so real-world attacks are not officially confirmed. A strong hint, not proof is the accurate reading.

As of publication this CVE is not in CISA's KEV catalogue, no EPSS exploitation-likelihood score has been calculated, and no exploit code has appeared. It is only hours old — none of that means "safe."

CVE-2026-61425: impersonating a Super User in Balbooa Gridbox

The same vendor's page-builder extension, Balbooa Gridbox, had its own flaw published on July 20: CVE-2026-61425 bypasses the authentication check and lets an attacker act as a Joomla Super User, the highest privilege level. Severity is 9.4 on CVSS 4.0, classified CWE-288 (authentication bypass by alternate path).

Versions 1.0.0 through 2.20.0.2 are affected; 2.20.1 fixes it. It is a different product from Balbooa Forms, but plenty of sites run several extensions from the same vendor. While you are fixing Forms, check the Gridbox version too.

This one currently carries a low EPSS score of about 0.003 and no observed attacks — a very different situation from the Balbooa Forms flaw of the same period, which sits at 0.76, in the top percentile.

What are Balbooa Forms and iCagenda

Joomla is a website-building system (CMS) widely used around the world alongside WordPress. An extension (plugin) is a part that adds functionality to Joomla after the fact. The two at issue here are both popular Joomla extensions. Balbooa Forms is a form builder for creating inquiry and application forms by drag and drop. iCagenda is an event-calendar extension for posting and accepting events, including a feature that lets visitors submit their own events.

Both share a feature that lets users or visitors attach and submit files. A "window that receives files from outside," like a form attachment or an event submission, can become an entry point for taking over a server if the receiving side checks too loosely and a program file is sent in. RCE (remote code execution) in Joomla page-building tools was just reported in the vulnerability in two page builders such as SP Page Builder, and on the WordPress side the same pattern recurs, as with the takeover vulnerability in the form builder plugin Super Forms.

What is dangerous, and how far can the damage spread

Both are flaws specialists call "arbitrary file upload." These features should only accept certain kinds of files, such as images or PDFs, but they were receiving files without checking their type. As a result, an attacker can send in a program file (a PHP file) that can execute commands on the server, and have it run as-is. The U.S. National Institute of Standards and Technology (NIST) classifies this as unrestricted upload of dangerous file types (CWE-434).

Once the planted program runs on the server, the attacker seizes the site's admin rights and can do virtually anything — defacing pages, exfiltrating member information and inquiry data, even using the server as a springboard to attack other sites. Exploitation requires no login; the attacker just sends crafted requests to a public form or event-submission page. The severity of 9.8 reflects the fact that a server can be seized without any special privileges or user action.

The most serious point is that these are already being actively exploited. The iCagenda flaw was a "zero-day" (an attack before a fix existed), with an automated program identifying itself as "icagenda-batch/1.0" reported to be scanning for and attacking unprotected sites. Balbooa Forms likewise had confirmed exploitation before the fix was released. Vulnerabilities confirmed to be exploited become targets of urgent CISA warnings, as with the takeover vulnerability in Oracle EBS and the SharePoint Server vulnerability.

Who targets these holes, and what happens

Exploiting these are attackers who deface sites to use as springboards for fake pages and spam, and ransomware groups that take over servers to demand a ransom. Because it can be done without even logging in, they automatically scan for vulnerable Joomla sites and attack them en masse once found. In fact, for iCagenda, an automated scanner named "icagenda-batch/1.0" has been observed indiscriminately crawling sites and sending in PHP files, showing that this technique is active right now.

The flow of attack is startlingly simple. Attackers send a program file disguised as an image or the like to a public form or event-submission window, then run it on the server to seize control of the site. All it takes is a few requests, with no click or action required from the victim. Sites left un-updated after being outsourced make especially easy targets.

As a result, the individuals and businesses running the sites have their public pages defaced, or the personal data collected through forms and events stolen wholesale. A hijacked site is turned, without the owner's knowledge, into a base for phishing or malware distribution, and visitors can be harmed too. Once control is lost, recovery costs time and money, and the site's very credibility is damaged.

What is happening from a technical standpoint

Each of the two flaws, reported in quick succession, has an identifier assigned.

CVE-2026-56291: Balbooa Forms, site takeover via unauthenticated file upload (severity 9.8)

The form-submission processing in Balbooa Forms (internal name com_baforms) was missing the mechanism to validate the type of attached files. As a result, an attacker who is not logged in can send an executable PHP file into a public folder and call it directly from the web to run it. Once the planted file executes, the attacker's commands run on the server. Affected are versions 1.0 through 2.4.0, and the vendor fixed it in 2.4.1, released on July 9, 2026. This flaw is reported to have been exploited before the fix was released, and it is listed in CISA's Known Exploited Vulnerabilities catalog (KEV).

CVE-2026-48939: iCagenda, PHP execution from the event-submission form (severity 9.8, actively exploited)

In iCagenda, the file-attachment feature used when visitors submit an event had the same flaw of receiving files without checking their type. Without any login, an attacker can send a PHP program (a "web shell," a back door for remote control) through the event-submission form and take over the server. Affected are 3.2.1 through 3.9.14, and 4.0.0 through 4.0.7; the vendor released 4.0.8 on June 15, 2026, and 3.9.15 the next day for the legacy branch. Exploitation by an automated scanner identifying as "icagenda-batch/1.0" has been observed, and a proof-of-concept reproducing the attack has been published. Because it was targeted before the fix was released, this is a high-urgency case.

Affected versions and countermeasures

Affected and fixed versions for three Balbooa flaws and one iCagenda flaw. Balbooa Forms appears twice because the two flaws have different affected ranges. If you want both closed, there is only one number to care about: 2.4.3.

As a stopgap if you cannot update immediately, temporarily disabling the affected extension or temporarily taking the form or event-submission page offline can narrow the entry points. But since they are already being widely targeted, these are only time-buying measures. Fundamentally, you need to update to the latest version and check whether you have been breached.

What is confirmed, and what is still unknown

What you can do right now

The core countermeasure is clear. The top priority is to update Balbooa Forms to 2.4.1 and iCagenda to 4.0.8 (3.9.15 for the legacy branch). Because exploitation is already confirmed, every bit of delay raises the risk of takeover. Check for extension updates from the Joomla admin panel and apply the latest version.

Beyond updating, checking whether you have already been breached is important. See whether unfamiliar PHP files have been placed in the server's upload folder, whether unknown admin accounts have appeared, and whether any pages have been defaced. Suspicious access such as "icagenda-batch" in your access logs is also a clue. If you suspect a breach, consider restoring from a backup or consulting a security professional. Flaws in features that receive files recur regardless of product, as with the vulnerability in the booking plugin LatePoint, so deleting unused extensions and keeping only the active ones up to date is the basic principle.

Frequently asked questions

Summary

Four serious vulnerabilities in Joomla extensions in July alone. The newest, CVE-2026-65880, allows unauthenticated code execution through the Signature field in Balbooa Forms at a maximum severity of 10.0. Only 2.4.3 is safe — neither 2.4.1 nor 2.4.2, both offered as fixes in July, closes it. The previously reported iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) flaws are already under attack and listed in CISA's KEV catalogue. The Gridbox issue (CVE-2026-61425) shows no sign of exploitation so far.

The work is: Balbooa Forms to 2.4.3, Gridbox to 2.20.1, iCagenda to 4.0.8 (3.9.15 on the legacy branch). And do not stop at updating. During the July incident, the vendor's own community reported that updating to 2.4.1 does not remove malware already planted. Check your upload folders for unfamiliar PHP files and your user list for new administrators before calling it done.

One honest note on scale. Joomla runs about 1.7% of sites whose CMS is known, and Balbooa Forms is a paid extension used by a fraction of those — so the affected population is not large. But for the sites that do run it, a perfect 10.0 lands in full. If that is you, the size of the population is irrelevant. We will update this article as the situation develops.

References

• ▸ NVD - CVE-2026-56291 (Balbooa Forms)
• ▸ NVD - CVE-2026-65880 (Balbooa Forms, Signature field)
• ▸ Balbooa - Forms Signature Field Security Release (vendor notice, July 28 2026)
• ▸ NVD - CVE-2026-61425 (Balbooa Gridbox)
• ▸ Balbooa - community notice on the July compromises
• ▸ NVD - CVE-2026-48939 (iCagenda)
• ▸ CISA - Known Exploited Vulnerabilities Catalog
• ▸ mySites.guru - iCagenda Zero Day File Upload RCE