Critical Joomla Flaws Face Federal Order

A pair of severe security vulnerabilities targeting popular Joomla extensions has triggered a formal intervention from the Cybersecurity and Infrastructure Security Agency. These flaws, which carry the highest possible risk ratings, are being actively weaponized by attackers to inject malicious code and seize control of affected web servers.

Perfect Ten Vulnerability Ratings

The two vulnerabilities, newly listed bugs in the CISA Known Exploited Vulnerabilities catalog, have been assigned a maximum CVSS score of 10. These flaws impact iCagenda, an event management tool, and Balbooa Forms, a widely used builder for surveys and contact requests. Both vulnerabilities function by permitting the unauthorized upload of files, which adversaries then execute as PHP code to achieve remote site takeover.

Technical Exploitation Paths

The attack surface for these extensions centers on how they handle file inputs. In the case of iCagenda, the vulnerability resides within the extension's attachment functionality. By bypassing standard controls, attackers can upload malicious PHP files through the "Submit an Event" feature, an element designed to allow visitor contributions.

The Balbooa Forms flaw operates through a similarly insecure frontend upload endpoint. According to security research, the extension previously accepted files from anonymous visitors without requiring authentication or implementing cross-site request forgery protections. This allowed for the direct placement of executable code into publicly accessible directories.

• CVE-2026-48939: Affects iCagenda, specifically the file attachment feature.
• CVE-2026-56291: Affects Balbooa Forms, targeting the unauthenticated frontend upload endpoint.
• 1.2 percent: The estimated share of all global websites powered by the Joomla platform.
• 1,000,000: The approximate number of websites worldwide running on Joomla.

Visibility Into Active Campaigns

Security firm mySites.guru documented the progression of these attacks, noting that automated scanning for vulnerable installations began occurring before official patches were released. In the case of the Balbooa Forms vulnerability, researchers identified the flaw while responding to a specific abuse report from a client whose site had already been compromised by attackers.

The iCagenda bug allows attackers to upload a malicious PHP file through the extension's attachment feature, turning what should be a simple file upload into remote code execution.

— CISA

Implications for Website Security

The rapid transition from vulnerability discovery to federal intervention highlights the elevated risk for organizations utilizing third-party extensions. Because Joomla's core platform relies heavily on these independent, external components to manage complex site features, a single vulnerability in a third-party plugin can invalidate the security posture of an entire installation. For administrators of public-facing sites, the immediate application of patches—version 4.0.8 and 3.9.15 for iCagenda, and 2.4.1 for Balbooa Forms—is the only mechanism to neutralize the current, ongoing threat of unauthorized remote execution.