Which versions of Aimy Form Guard are affected by CVE-2026-65883?

The Aimy Captcha-Less Form Guard plugin for Joomla (versions 18.0-20.0) contains a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code and…

How to fix or mitigate CVE-2026-65883?

Within 24 hours, inventory all Joomla installations to identify any running versions 18.0-20.0 of the Aimy Captcha-Less Form Guard plugin and immediately disable or uninstall the affected plugin. Within 7 days, conduct forensic analysis of web server logs, PHP execution logs, and file integrity monitoring data covering the vulnerability window to detect indicators of compromise, focusing on suspicious PHP deserialization events and unauthorized code execution in web root directories. Within 30 days, evaluate and migrate to alternative form plugins with active security support, implement a vendor security advisory monitoring process, and establish WAF rules to block requests containing the vulnerable 'clfgd' form field parameter if immediate plugin removal is operationally infeasible.

Aimy Form Guard CVE-2026-65883

Q: What is the CVSS score of CVE-2026-65883?

CVE-2026-65883 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-50275 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-29 Joomla

GHSA-4f62-78r3-84fq

PHP RCE Deserialization Aimy Captcha Less Form Guard Plugin For Joomla

10.0

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network-reachable deserialization RCE (AV:N/AC:L/PR:N/UI:N) with code execution escaping the app to the host, so S:C and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 10:52 vuln.today

CVE Published

Jul 29, 2026 - 09:34 cve.org

CRITICAL 10.0

DescriptionCVE.org

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.

Articles & Coverage 1

News Critical RCE in Joomla Aimy Captcha-Less Form Guard Plugin - CVE-2026-65883 Jul 30, 2026

AnalysisAI

Remote code execution in the Aimy Captcha-Less Form Guard plugin for Joomla (versions 18.0 through 20.0) allows unauthenticated attackers to run arbitrary PHP by submitting a forged 'clfgd' form field that the plugin deserializes, triggering PHP object injection. Any unpatched Joomla site running this plugin is exposed to full server compromise over the network without authentication or user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CWE-502 root cause and maximal CVSS 4.0 score (10.0) make this a critical-priority issue.

Technical ContextAI

The affected component is a Joomla content-management extension (cpe:2.3:a:aimy-extensions.com:aimy_captcha-less_form_guard_plugin_for_joomla) that provides captcha-less spam protection for Joomla forms. The root cause is CWE-502, Deserialization of Untrusted Data: the plugin's guard field ('clfgd') carries attacker-supplied serialized PHP that is passed to PHP's unserialize() (or equivalent) without validation. When PHP reconstructs objects from this data, it can invoke magic methods (e.g. __wakeup, __destruct) on classes present in the Joomla runtime, forming a POP (property-oriented programming) gadget chain that culminates in arbitrary code execution. This is a classic PHP object injection pattern where the deserialization primitive, not a memory bug, drives exploitation.

RemediationAI

No vendor-released patch version is identified in the available data, so verify fix availability directly at the vendor page https://www.aimy-extensions.com/joomla/captcha-less-form-guard.html and upgrade to any release later than 20.0 once published. As immediate compensating controls until a patched build is confirmed: disable or uninstall the Aimy Captcha-Less Form Guard plugin from the Joomla extension manager to remove the deserialization entry point (side effect: forms lose this plugin's spam protection and may need an alternative captcha); or deploy a WAF rule to block or strip requests containing the 'clfgd' parameter with serialized-object markers such as 'O:' or '__' payloads (side effect: risk of false positives on legitimate form traffic). Restrict access to public-facing form endpoints and monitor web logs for anomalous POST bodies targeting affected forms. Do not rely on version guessing - cite the exact fixed version only once the vendor publishes it.