Affected versions: > 2.1.4-j3sec and < 2.2.7
Full advisory: www.joomshaper.com
CVE-2026-57830CriticalPublished 7 July 2026
Helix Ultimate Framework (helixultimate) below 2.2.7 - Unauthenticated Broken Access Control (Stored XSS and Super-User Creation via Mega Menu)
Helix Ultimate versions before 2.2.7 expose several front-end com_ajax tasks (saveMegaMenuSettings, getMenuItems and deleteMedia) with no ACL or CSRF check (CWE-862, Missing Authorization). An unauthenticated attacker can call saveMegaMenuSettings to write arbitrary content into any menu item params (the helixultimatemenulayout badge and custom_html fields in the #__menu table) and enumerate the whole menu tree via getMenuItems. In the wild this stores a self-propagating XSS payload (CWE-79) that, when a logged-in administrator renders the menu, silently creates a rogue Super User and beacons the credentials to an external server. Fixed in 2.2.7, which enforces CSRF token and permission checks across all Helix Ultimate AJAX actions; 2.2.8 is the current release. Confirmed exploited in the wild in July 2026. Action: update to 2.2.8 now, then audit #__menu params for injected script tags and #__users for unexpected Super User accounts. Temporary mitigation: block requests where option=com_ajax and plugin=helixultimate at the firewall or WAF until updated.
Affected versions: > 2.1.4-j3sec and < 2.2.7
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Helix Ultimate - Helix Ultimate (shaper_helixultimate) below 2.2.7 - Unauthenticated Broken Access Control (Stored XSS and Super-User Creation via Mega Menu)
Helix Ultimate versions before 2.2.7 expose several front-end com_ajax tasks (saveMegaMenuSettings, getMenuItems and deleteMedia) with no ACL or CSRF check (CWE-862, Missing Authorization). An unauthenticated attacker can call saveMegaMenuSettings to write arbitrary content into any menu item params (the helixultimatemenulayout badge and custom_html fields in the #__menu table) and enumerate the whole menu tree via getMenuItems. In the wild this stores a self-propagating XSS payload (CWE-79) that, when a logged-in administrator renders the menu, silently creates a rogue Super User and beacons the credentials to an external server. Fixed in 2.2.7, which enforces CSRF token and permission checks across all Helix Ultimate AJAX actions; 2.2.8 is the current release. Confirmed exploited in the wild in July 2026. Action: update to 2.2.8 now, then audit #__menu params for injected script tags and #__users for unexpected Super User accounts. Temporary mitigation: block requests where option=com_ajax and plugin=helixultimate at the firewall or WAF until updated.
Affected versions: > 2.1.4-j3sec and < 2.2.7
Full advisory: www.joomshaper.com
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.