Affected versions: ≥ 5.2.3 and < 5.2.5
Full advisory: www.tassos.gr
CVE-2026-77026MediumCVSS 6.9
Convert Forms (com_convertforms) 5.2.3 to 5.2.4 (Joomla 4/5/6 branch) - Unauthenticated Client-Controlled Validation Bypass (CAPTCHA and field validation bypass, CVE-2026-77026)
Convert Forms 5.2.3 and 5.2.4 on the Joomla 4/5/6 branch let an unauthenticated visitor bypass CAPTCHA and other field validations by claiming the fields were hidden by Conditional Logic. Because the form decides which validation rules apply on the client side, a crafted submission can assert that a required or CAPTCHA-protected field was conditionally hidden and skip its validation entirely. The practical impact is spam and unvalidated data reaching your forms, your notification emails and any downstream integrations. It does not expose existing submissions. Tassos Marinos fixed it in Convert Forms 5.2.5, released 20 August 2026. Update to 5.2.5 or later. Sites on the Joomla 3 branch need 4.4.17 instead, which carries the same fix. CVE-2026-77026, CVSS 4.0 base 6.9 Medium (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L), credited to Murrez. Note: the published CVE description text actually describes an earlier and different flaw, unauthorised front-end viewing of form submissions, which was fixed back in 5.2.3 and is covered by a separate rule. The CVE title, its affected version range and its CVSS vector all match this validation bypass rather than that disclosure.
Affected versions: ≥ 5.2.3 and < 5.2.5
Official record: cve.org · NVD
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
How CVE-2026-77026 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
6.9 Medium
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:N Confidentiality
- None. Nothing can be read
- VI:L Integrity
- Low. Some data can be altered
- VA:L Availability
- Low. The site slows or stutters
What it does beyond the site
- SC:N Confidentiality
- None. Other systems keep their data
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
Affected extensions and versions
Convert Forms - Convert Forms (com_convertforms) 4.4.16 (Joomla 3 branch) - Unauthenticated Client-Controlled Validation Bypass (CAPTCHA and field validation bypass, CVE-2026-77026)
Convert Forms 4.4.16 on the Joomla 3 branch lets an unauthenticated visitor bypass CAPTCHA and other field validations by claiming the fields were hidden by Conditional Logic. Because the form decides which validation rules apply on the client side, a crafted submission can assert that a required or CAPTCHA-protected field was conditionally hidden and skip its validation entirely. The practical impact is spam and unvalidated data reaching your forms, your notification emails and any downstream integrations. It does not expose existing submissions. Tassos Marinos backported the fix to the Joomla 3 branch in Convert Forms 4.4.17, released 21 August 2026, one day after the 5.2.5 release on the Joomla 4/5/6 branch. Update to 4.4.17. CVE-2026-77026, CVSS 4.0 base 6.9 Medium (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L), credited to Murrez. Note: the published CVE description text actually describes an earlier and different flaw, unauthorised front-end viewing of form submissions, which was fixed on this branch in 4.4.16 and is covered by a separate rule. The CVE title, its affected version range and its CVSS vector all match this validation bypass rather than that disclosure.
Affected versions: ≥ 4.4.16 and < 4.4.17
Full advisory: www.tassos.gr
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 3 October 2026.