# Helix Ultimate Framework (helixultimate) below 2.2.7 - Unauthenticated Broken Access Control (Stored XSS and Super-User Creation via Mega Menu)

[Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-57830

CVE-2026-57830HighCVSS 8.8CVE published 13 July 2026Added to mySites.guru 7 July 2026

# Helix Ultimate Framework (helixultimate) below 2.2.7 - Unauthenticated Broken Access Control (Stored XSS and Super-User Creation via Mega Menu)

Helix Ultimate versions before 2.2.7 expose several front-end com\_ajax tasks (saveMegaMenuSettings, getMenuItems and deleteMedia) with no ACL or CSRF check (CWE-862, Missing Authorization). An unauthenticated attacker can call saveMegaMenuSettings to write arbitrary content into any menu item params (the helixultimatemenulayout badge and custom\_html fields in the #\_\_menu table) and enumerate the whole menu tree via getMenuItems. In the wild this stores a self-propagating XSS payload (CWE-79) that, when a logged-in administrator renders the menu, silently creates a rogue Super User and beacons the credentials to an external server. Fixed in 2.2.7, which enforces CSRF token and permission checks across all Helix Ultimate AJAX actions; 2.2.8 is the current release. Confirmed exploited in the wild in July 2026. Action: update to 2.2.8 now, then audit #\_\_menu params for injected script tags and #\_\_users for unexpected Super User accounts. Temporary mitigation: block requests where option=com\_ajax and plugin=helixultimate at the firewall or WAF until updated.

Copy citation

## Is my site affected?

CVE-2026-57830 is checked by 2 rules. Find the extension and release line your site runs:

Extension

Affected versions

Fixed in

What to do

[Helix Ultimate Framework](https://mysites.guru/vulnerabilities/helixultimate/)

after 2.1.4-j3sec up to but not including 2.2.7

2.2.7

Update Helix Ultimate Framework to 2.2.7 for this flaw, or to 2.2.10 or later, which no rule we check matches.

[Helix Ultimate](https://mysites.guru/vulnerabilities/shaper-helixultimate/)

after 2.1.4-j3sec up to but not including 2.2.7

2.2.7

Update Helix Ultimate to 2.2.7 for this flaw, or to 2.2.10 or later, which no rule we check matches.

[Check whether your sites are affected](https://mysites.guru/free-audit/)

## How CVE-2026-57830 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

8.8 High

CVSS 4.0, scored by Joomla CNA

`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N`

### How it is reached

- **AV:N Attack vector** - Network. Reachable across the internet
- **AC:L Attack complexity** - Low. Nothing to work around, it just works
- **AT:N Attack requirements** - None. Works against any affected install
- **PR:N Privileges required** - None. No account needed
- **UI:N User interaction** - None. Nobody has to be tricked into anything

### What it does to the site

- **VC:N Confidentiality** - None. Nothing can be read
- **VI:H Integrity** - High. Data and files can be altered at will
- **VA:H Availability** - High. The site can be taken down

### What it does beyond the site

- **SC:N Confidentiality** - None. Other systems keep their data
- **SI:N Integrity** - None. Other systems keep their integrity
- **SA:N Availability** - None. Other systems stay up

The rule below is rated Critical for the set of 2 CVEs it covers together, not for this record on its own.

## Timeline

1.  7 July 2026mySites.guru check added for Helix Ultimate Framework (after 2.1.4-j3sec up to but not including 2.2.7)
2.  7 July 2026mySites.guru check added for Helix Ultimate (after 2.1.4-j3sec up to but not including 2.2.7)
3.  13 July 2026CVE-2026-57830 record published by its CNA

## Rule details

Critical[CVE-2026-57829](https://mysites.guru/vulnerabilities/CVE-2026-57829/)[CVE-2026-57830](https://mysites.guru/vulnerabilities/CVE-2026-57830/)2026-07-07

[Helix Ultimate Framework](https://mysites.guru/vulnerabilities/helixultimate/)

Affected versions: \> 2.1.4-j3sec and < 2.2.7

Full advisory: [www.joomshaper.com](https://www.joomshaper.com/blog/security-update-for-joomla-3-users)

Critical[CVE-2026-57829](https://mysites.guru/vulnerabilities/CVE-2026-57829/)[CVE-2026-57830](https://mysites.guru/vulnerabilities/CVE-2026-57830/)2026-07-07

[Helix Ultimate](https://mysites.guru/vulnerabilities/shaper-helixultimate/) - Helix Ultimate (shaper\_helixultimate) below 2.2.7 - Unauthenticated Broken Access Control (Stored XSS and Super-User Creation via Mega Menu)

Helix Ultimate versions before 2.2.7 expose several front-end com\_ajax tasks (saveMegaMenuSettings, getMenuItems and deleteMedia) with no ACL or CSRF check (CWE-862, Missing Authorization). An unauthenticated attacker can call saveMegaMenuSettings to write arbitrary content into any menu item params (the helixultimatemenulayout badge and custom\_html fields in the #\_\_menu table) and enumerate the whole menu tree via getMenuItems. In the wild this stores a self-propagating XSS payload (CWE-79) that, when a logged-in administrator renders the menu, silently creates a rogue Super User and beacons the credentials to an external server. Fixed in 2.2.7, which enforces CSRF token and permission checks across all Helix Ultimate AJAX actions; 2.2.8 is the current release. Confirmed exploited in the wild in July 2026. Action: update to 2.2.8 now, then audit #\_\_menu params for injected script tags and #\_\_users for unexpected Super User accounts. Temporary mitigation: block requests where option=com\_ajax and plugin=helixultimate at the firewall or WAF until updated.

Affected versions: \> 2.1.4-j3sec and < 2.2.7

Full advisory: [www.joomshaper.com](https://www.joomshaper.com/blog/security-update-for-joomla-3-users)

## Other vulnerabilities in Helix Ultimate Framework and Helix Ultimate

Updating for CVE-2026-57830 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.

### [Helix Ultimate Framework](https://mysites.guru/vulnerabilities/helixultimate/)

Latest safe version: 2.2.10

-   [CVE-2026-57829](https://mysites.guru/vulnerabilities/CVE-2026-57829/) Critical, after 2.1.4-j3sec up to but not including 2.2.7
-   [CVE-2026-78075](https://mysites.guru/vulnerabilities/CVE-2026-78075/) High, from 2.2.7 up to but not including 2.2.10
-   [CVE-2026-78076](https://mysites.guru/vulnerabilities/CVE-2026-78076/) High, from 2.2.7 up to but not including 2.2.10
-   [CVE-2026-78077](https://mysites.guru/vulnerabilities/CVE-2026-78077/) High, from 2.2.7 up to but not including 2.2.10
-   [CVE-2026-78078](https://mysites.guru/vulnerabilities/CVE-2026-78078/) High, from 2.2.7 up to but not including 2.2.10
-   [CVE-2026-78079](https://mysites.guru/vulnerabilities/CVE-2026-78079/) High, from 2.2.7 up to but not including 2.2.10

### [Helix Ultimate](https://mysites.guru/vulnerabilities/shaper-helixultimate/)

Latest safe version: 2.2.10

-   [CVE-2026-57829](https://mysites.guru/vulnerabilities/CVE-2026-57829/) Critical, after 2.1.4-j3sec up to but not including 2.2.7
-   [CVE-2026-78075](https://mysites.guru/vulnerabilities/CVE-2026-78075/) High, from 2.2.7 up to but not including 2.2.10
-   [CVE-2026-78076](https://mysites.guru/vulnerabilities/CVE-2026-78076/) High, from 2.2.7 up to but not including 2.2.10
-   [CVE-2026-78077](https://mysites.guru/vulnerabilities/CVE-2026-78077/) High, from 2.2.7 up to but not including 2.2.10
-   [CVE-2026-78078](https://mysites.guru/vulnerabilities/CVE-2026-78078/) High, from 2.2.7 up to but not including 2.2.10
-   [CVE-2026-78079](https://mysites.guru/vulnerabilities/CVE-2026-78079/) High, from 2.2.7 up to but not including 2.2.10

## References

-   [CVE-2026-57830 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-57830)
-   [CVE-2026-57830 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-57830)
-   [joomshaper.com/blog/security-update-for-joomla-3-users](https://www.joomshaper.com/blog/security-update-for-joomla-3-users)

## CVE-2026-57830 questions

Show all

Which versions are affected by CVE-2026-57830?

[CVE-2026-57830](https://mysites.guru/vulnerabilities/CVE-2026-57830/) is covered by 2 rules: Helix Ultimate Framework after 2.1.4-j3sec up to but not including 2.2.7; Helix Ultimate after 2.1.4-j3sec up to but not including 2.2.7.

How do I fix CVE-2026-57830?

It depends on the extension and release line your site runs. For Helix Ultimate Framework after 2.1.4-j3sec up to but not including 2.2.7: update Helix Ultimate Framework to 2.2.7 for this flaw, or to 2.2.10 or later, which no rule we check matches. For Helix Ultimate after 2.1.4-j3sec up to but not including 2.2.7: update Helix Ultimate to 2.2.7 for this flaw, or to 2.2.10 or later, which no rule we check matches.

How severe is CVE-2026-57830?

Joomla CNA scores it 8.8 (High) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

## Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day.

This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/).

Rules current as of 14 October 2026.