Aimy Captcha Less Form Guard Plugin For Joomla
Monthly
Remote code execution in the Aimy Captcha-Less Form Guard plugin for Joomla (versions 18.0 through 20.0) allows unauthenticated attackers to run arbitrary PHP by submitting a forged 'clfgd' form field that the plugin deserializes, triggering PHP object injection. Any unpatched Joomla site running this plugin is exposed to full server compromise over the network without authentication or user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CWE-502 root cause and maximal CVSS 4.0 score (10.0) make this a critical-priority issue.
Remote code execution in the Aimy Captcha-Less Form Guard plugin for Joomla (versions 18.0 through 20.0) allows unauthenticated attackers to run arbitrary PHP by submitting a forged 'clfgd' form field that the plugin deserializes, triggering PHP object injection. Any unpatched Joomla site running this plugin is exposed to full server compromise over the network without authentication or user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CWE-502 root cause and maximal CVSS 4.0 score (10.0) make this a critical-priority issue.