Helix Ultimate Mega Menu Hack

What this check and mySites.guru tool looks at on your site

Helix Ultimate is one of the most widely used Joomla template frameworks, and this check reads every menu item on a site whose params carry a Helix Ultimate mega-menu layout straight from the Joomla database, decodes the nested layout, and inspects every setting inside it at any depth: the badge, the custom HTML, the CSS class, and anything buried in the rows and columns. The attacker chooses where to write, so the check is not limited to a fixed list of fields.

A menu item is only flagged on unmistakable injection tells: loader fingerprints such as code run through eval or atob, a script sourced from a data: or blob: URI, a script whose src is really a font, image or stylesheet file (no script is ever legitimately served from a .ttf or .png), an external fetch or sendBeacon call to a hard-coded host, the self-registration shape that quietly creates a new Super User account from a visitor’s browser, or script and markup where only a plain label or class name belongs. A quote character inside a CSS class field is a particular tell, since that is how the attacker breaks out of the attribute and opens a script tag. Real badges, custom HTML, embedded widgets and class names match none of these and are never flagged.

How an anonymous write reaches your admin session

Versions of Helix Ultimate before 2.2.7, the release that closed this unauthenticated menu write, registered an ajax handler, saveMegaMenuSettings, reached anonymously through Joomla’s com_ajax dispatcher, that saved its settings before checking who was asking. That let an anonymous attacker write mega-menu settings straight into the #__menu params in the database, all of which Joomla echoes into the page that renders the menu. The flaw is tracked as CVE-2026-57829 and CVE-2026-57830, both assigned by the Joomla CNA in July 2026.

The campaign observed in the wild writes a stored cross-site scripting payload: a script planted in one of those settings that runs in the browser of anyone who loads a page carrying that menu, including an administrator. Because the script runs in an authenticated admin session the moment a logged-in editor opens a page using the poisoned menu, it does not need its own login at all. It then submits Joomla’s own registration form to create a hidden Super User account and beacons out to a command server, so by the time anyone notices the injected content the site may already have a second, silent way in. Because the payload lives in a database column rather than a file, the site’s files all hash clean, which is exactly why a database-side check is needed to catch it. Cleaning the menu items is only half the job: the worm leaves a rogue Super User behind, so a flagged site should always get a full check for rogue admin accounts as well, and treating one poisoned menu item as the whole of the compromise is the mistake that lets the attacker walk straight back in through the account they already planted.

The difference between a badge and a backdoor

Every menu item’s mega-menu settings contain only content your team put there: real badge text, intentional custom HTML, and class names free of quote characters or angle brackets. Nothing in the layout fetches from an external host, rewrites the page title, or submits a form on the visitor’s behalf.

How to fix it

1. Update Helix Ultimate to the current version first. Cleaning without patching invites an immediate re-injection, since the vulnerable versions accept the same write from any anonymous visitor. In the administrator, go to System, then Update, then Extensions, and update Helix Ultimate.
2. Preserve anything you need before cleaning. If any of the affected settings held content you wrote yourself, copy it out. The clean-up below removes it.
3. Inspect and clean every menu item’s mega-menu settings. In the administrator, go to Menus, open each menu item using a Helix Ultimate mega-menu layout, and check the badge, custom HTML, CSS class and nested rows/columns for any of the tells described above. Remove anything that matches; leave everything else untouched.
4. Check for a rogue Super User. The observed campaign uses this foothold to create a hidden Super User account. See Rogue Super Admin Accounts and remove anything you do not recognise.
5. Clear the Joomla cache so no cached page keeps serving the injected script after the clean-up.
6. Check the rest of your portfolio. This is automated, sprayed tooling; every site running Helix Ultimate below the current version is a target.

What mySites.guru does about it

On every snapshot, twice a day, mySites.guru decodes every mega-menu layout on the site and checks it against the tells above, at any depth. Where a setting matches, we show you exactly which field triggered the flag and an excerpt of what is in it, so you can verify it before anything changes.