Affected versions: ≥ 5.2.3 and < 5.2.5
Full advisory: www.tassos.gr
CVE-2026-77026MediumCVSS 6.9CVE published 20 August 2026
Convert Forms (com_convertforms) 5.2.3 to 5.2.4 (Joomla 4/5/6 branch) - Unauthenticated Client-Controlled Validation Bypass (CAPTCHA and field validation bypass, CVE-2026-77026)
Convert Forms 5.2.3 and 5.2.4 on the Joomla 4/5/6 branch let an unauthenticated visitor bypass CAPTCHA and other field validations by claiming the fields were hidden by Conditional Logic. Because the form decides which validation rules apply on the client side, a crafted submission can assert that a required or CAPTCHA-protected field was conditionally hidden and skip its validation entirely. The practical impact is spam and unvalidated data reaching your forms, your notification emails and any downstream integrations. It does not expose existing submissions. Tassos Marinos fixed it in Convert Forms 5.2.5, released 20 August 2026. Update to 5.2.5 or later. Sites on the Joomla 3 branch need 4.4.17 instead, which carries the same fix. CVE-2026-77026, CVSS 4.0 base 6.9 Medium (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L), credited to Murrez. Note: the published CVE description text actually describes an earlier and different flaw, unauthorised front-end viewing of form submissions, which was fixed back in 5.2.3 and is covered by a separate rule. The CVE title, its affected version range and its CVSS vector all match this validation bypass rather than that disclosure.
Is my site affected?
CVE-2026-77026 is checked by 2 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| Convert Forms | from 5.2.3 up to but not including 5.2.5 | 5.2.5 | Update Convert Forms to 5.2.5 or later. |
| Convert Forms | from 4.4.16 up to but not including 4.4.17 | 4.4.17 | Update Convert Forms to 4.4.17 or later. |
How CVE-2026-77026 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
6.9 Medium
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:N Confidentiality
- None. Nothing can be read
- VI:L Integrity
- Low. Some data can be altered
- VA:L Availability
- Low. The site slows or stutters
What it does beyond the site
- SC:N Confidentiality
- None. Other systems keep their data
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
Timeline
- 20 August 2026CVE-2026-77026 record published by its CNA
Rule details
Convert Forms - Convert Forms (com_convertforms) 4.4.16 (Joomla 3 branch) - Unauthenticated Client-Controlled Validation Bypass (CAPTCHA and field validation bypass, CVE-2026-77026)
Convert Forms 4.4.16 on the Joomla 3 branch lets an unauthenticated visitor bypass CAPTCHA and other field validations by claiming the fields were hidden by Conditional Logic. Because the form decides which validation rules apply on the client side, a crafted submission can assert that a required or CAPTCHA-protected field was conditionally hidden and skip its validation entirely. The practical impact is spam and unvalidated data reaching your forms, your notification emails and any downstream integrations. It does not expose existing submissions. Tassos Marinos backported the fix to the Joomla 3 branch in Convert Forms 4.4.17, released 21 August 2026, one day after the 5.2.5 release on the Joomla 4/5/6 branch. Update to 4.4.17. CVE-2026-77026, CVSS 4.0 base 6.9 Medium (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L), credited to Murrez. Note: the published CVE description text actually describes an earlier and different flaw, unauthorised front-end viewing of form submissions, which was fixed on this branch in 4.4.16 and is covered by a separate rule. The CVE title, its affected version range and its CVSS vector all match this validation bypass rather than that disclosure.
Affected versions: ≥ 4.4.16 and < 4.4.17
Full advisory: www.tassos.gr
Other vulnerabilities in Convert Forms
Updating for CVE-2026-77026 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
Convert Forms
Latest safe version: 5.2.5
- CVE-2026-65758 High, from 4.4.10 up to but not including 4.4.16
- CVE-2024-40744 before 4.4.10
- CVE-2024-40745 before 4.4.10
- CVE-2025-22212 before 4.4.10
References
- CVE-2026-77026 on cve.org (the official CVE record)
- CVE-2026-77026 in the NIST National Vulnerability Database
- tassos.gr/releases/convert-forms/convert-forms-5-2-5
- tassos.gr/releases/convert-forms/convert-forms-4-4-17
CVE-2026-77026 questions
Which versions are affected by CVE-2026-77026?
CVE-2026-77026 is covered by 2 rules: Convert Forms from 5.2.3 up to but not including 5.2.5; Convert Forms from 4.4.16 up to but not including 4.4.17.
How do I fix CVE-2026-77026?
It depends on the extension and release line your site runs. For Convert Forms from 5.2.3 up to but not including 5.2.5: update Convert Forms to 5.2.5 or later. For Convert Forms from 4.4.16 up to but not including 4.4.17: update Convert Forms to 4.4.17 or later.
How severe is CVE-2026-77026?
Joomla CNA scores it 6.9 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 24 October 2026.