Tassos Framework CVE-2026-48906

Exploitation requires the target Joomla site to have any Tassos.gr extension that bundles the vulnerable NR Framework system plugin (plg_system_nrframework) installed and enabled - Convert Forms, EngageBox, Advanced Custom Fields, Google Structured Data, Smile Pack, MailChimp Auto-Subscribe, or Tassos Code Snippets - at a version within the EUVD-listed affected ranges (e.g., NR Framework ≤6.0.1, Convert Forms ≤5.1.5, EngageBox ≤7.1.1). Per CVSS PR:N/UI:N and the 'Authentication Bypass' tag, no authentication, privileges, or user interaction are needed, so any default deployment of an affected version is reachable by remote unauthenticated attackers. The limiting factors are therefore solely whether a vulnerable Tassos extension is present and active and whether it is at an unpatched version; sites without these extensions, or running a fixed version, are not exposed.

Signals are mixed and should be weighed together. The CVSS 4.0 score of 9.3 with AV:N/AC:L/AT:N/PR:N/UI:N describes trivial, remote, unauthenticated, low-complexity exploitation against default installations, and AU:Y (Automatable) plus SSVC Automatable:yes mean it can be scripted at scale. Against that, EPSS is very low (0.07%, 21st percentile), SSVC Exploitation is 'none', and there is no CISA KEV entry and no public exploit identified at time of analysis - so the theoretical ease of exploitation has not translated into observed activity. Note a mild discrepancy worth verifying: SSVC rates Technical Impact as 'partial' while the CVSS vector rates integrity and availability as High (VI:H/VA:H, SI:H/VA:H); arbitrary file deletion plausibly justifies the higher rating. Overall this is a real priority for any site running an affected Tassos extension because exploitation requires no privileges and is automatable, but the absence of exploitation evidence suggests patching can be planned rather than treated as an active incident.

An attacker scans for Joomla sites running any Tassos.gr extension, then sends a crafted unauthenticated HTTP request to the NR Framework's file-handling endpoint specifying a target path. Because no authentication or user interaction is required (PR:N/UI:N), the request deletes the chosen file - for example configuration.php or other core files - causing a denial of service and potentially exposing the site to reinstallation/takeover. No public proof-of-concept has been identified at time of analysis, but the automatable, low-complexity nature of the flaw means a working exploit could be mass-deployed quickly.