Convert Forms Extension For Joomla
Monthly
Unauthenticated access to form submissions is possible in the Convert Forms extension for Joomla across all versions from 1.0.0 up to but not including 5.2.5, due to missing server-side access control on the front-end Submissions view. Any unauthenticated internet visitor can enumerate and retrieve form submission data without credentials, exposing whatever personally identifiable or business-sensitive information site visitors have submitted through forms built with this extension. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack surface makes this trivially exploitable by any actor who can reach the site.
Unauthenticated access to form submissions is possible in the Convert Forms extension for Joomla across all versions from 1.0.0 up to but not including 5.2.5, due to missing server-side access control on the front-end Submissions view. Any unauthenticated internet visitor can enumerate and retrieve form submission data without credentials, exposing whatever personally identifiable or business-sensitive information site visitors have submitted through forms built with this extension. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack surface makes this trivially exploitable by any actor who can reach the site.