Balbooa Forms EUVD-2026-89099

Exploitation requires a target Joomla site running Balbooa Forms < 2.4.3.4 where an administrator has enabled the extension's OPTIONAL 'PHP-after-submission' action AND has interpolated an attacker-controllable form-field shortcode inside a double-quoted PHP string within that code. When those conditions hold, exploitation is remote and unauthenticated (PR:N/UI:N) via a normal public form submission against default network exposure. The limiting factor is entirely this non-default administrator configuration (reflected as AT:P in the 4.0 vector); sites that do not use the PHP-after-submission feature, or that do not interpolate submitted field shortcodes into the PHP, are not vulnerable.

The vendor CVSS 4.0 score of 9.5 (critical) reflects CWE-94 code injection reaching PHP eval() with full VC/VI/VA:H and SC/SI/SA:H, i.e. server-side remote code execution. Two signals temper the raw score. First, the 4.0 vector itself carries AT:P (Attack Requirements: Present) and the description confirms this: the flaw is only reachable when an administrator has (a) enabled the optional 'PHP-after-submission' action AND (b) interpolated an attacker-controlled field shortcode inside a double-quoted PHP string. This is a non-default, operator-created condition, so despite PR:N/UI:N the real-world exposed population is a subset of installs. Second, exploitation signals are absent: no EPSS score, not on CISA KEV, and no public POC identified at time of analysis - this is a Joomla-org-reported advisory with only a vendor homepage reference. So this is a genuinely high-impact RCE where a vulnerable configuration exists, but not currently evidenced as widely or actively exploited. Note the CVSS 4.0 AC:L (attacker's own action is trivial) coexists with AT:P (target must be configured a specific way); a 3.1 mapping folds that config dependency into AC:H, which is why my independent 3.1 base is lower than the headline 9.5.

An attacker identifies a public Balbooa Forms form on a Joomla site whose admin has enabled the PHP-after-submission action and embedded a field shortcode inside a double-quoted PHP string. The attacker submits the form with a malicious value in that field; the component substitutes the raw submitted value into the PHP source and passes it to eval(), executing attacker-supplied code on the web server. No public exploit code has been identified at time of analysis.