Fabrik CVE-2026-66915

Exploitation requires that the target Joomla site has the Fabrik extension (version < 4.6.7) installed and that the calc plugin's 'ajax_calc' AJAX feature is reachable over the network - this is the exact prerequisite named in the description. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attacker prerequisites are needed beyond network reach to the vulnerable endpoint: essentially unauthenticated remote exploitation against Fabrik installations exposing the calc/ajax_calc functionality. Limiting factors: the site must actually deploy Fabrik and expose the calc plugin path; installations where com_fabrik front-end access is restricted, or where no calc-plugin functionality is reachable, reduce exposure. Sites already on 4.6.7+ are not affected.

This is a genuine top-priority issue, not an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and subsequent-system impacts also High) describes remote, network-based, low-complexity, unauthenticated code execution with no user interaction - the exact profile that gets weaponized quickly once exploit details circulate. The vulnerability class (unauthenticated PHP code injection in a web-facing Joomla extension) is highly automatable and lends itself to mass scanning. That said, key real-world signals are missing from the provided data: no EPSS score is supplied, KEV status is not indicated (treat as not KEV-listed), and no POC reference is present, so at this moment there is no public exploit identified and no confirmation of active exploitation. The single reference is only the vendor homepage (fabrikar.com), not a dedicated advisory, so exact patch/version detail beyond the '< 4.6.7' fixed-version boundary should be verified with the vendor. Bottom line: the intrinsic severity is maximal and exploitation is expected to be trivial, so treat as urgent even though widespread exploitation is not yet evidenced.

An attacker scanning the internet for Joomla sites running Fabrik sends a crafted HTTP request to the com_fabrik component invoking the calc plugin's ajax_calc task with a malicious PHP expression as input. Because the endpoint requires no authentication and evaluates the expression server-side, the attacker's code runs in the web application's PHP context, yielding a webshell or command execution. No public POC is identified yet, but the low attack complexity and lack of authentication make reliable exploitation straightforward once request details are known.