Balbooa Forms (com_baforms) 2.4.3 to below 2.4.3.2 - Unauthenticated PHP Code Injection (RCE, CVSS 10.0) and Unauthenticated Payment Amount Tampering
Balbooa Forms 2.4.3 and 2.4.3.1 are affected by two unauthenticated flaws fixed in 2.4.3.2 on 18 August 2026 and published as CVEs by the Joomla CNA on 19 August 2026. CVE-2026-67364 (CWE-94 / CWE-95, CVSS 4.0 base 10.0 Critical, CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N) is a pre-auth PHP code injection: the form's optional custom-PHP post-submission handler is executed through eval(), and the [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, so an unauthenticated visitor can inject arbitrary PHP that runs server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously through a separate task, so it provides no real protection. Exploitation requires the form to have a custom-PHP handler configured (a documented form-builder feature) that references that shortcode, and no reCAPTCHA on the submit button, so not every install on these versions is exploitable - but that precondition is an ordinary builder setting and cannot be ruled out remotely. CVE-2026-67363 (CWE-472 / CWE-602, CVSS 4.0 base 7.7 High) is pre-auth payment amount tampering: the stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices, and neither endpoint enforces authentication or a CSRF check. An unauthenticated attacker can purchase any priced item for an arbitrary amount such as 0.01, and can additionally forge line items, quantities and shipping. Both CVE records give the affected range as 1.0.0 to 2.4.3.1. Balbooa originally presented 2.4.3.2 as routine hardening covering the Media Manager, path validation, payment validation, post-submission PHP scripts and signature image validation, and stated it was not related to any publicly disclosed vulnerability; these CVE records supersede that description, and two of those five areas are the ones above. This rule starts at 2.4.3 because it also absorbs the 2.4.3.1 hardening release of 31 July 2026, so a site on 2.4.3 is missing both sets of fixes. Update to Balbooa Forms 2.4.3.2 or later. If the site publishes a form with a custom-PHP post-submission handler, treat it as potentially compromised until checked: look for unfamiliar administrator accounts and for stray .php files under the upload folder (by default images/baforms/uploads/). If the site takes payments through a Balbooa form, reconcile recent Stripe or Authorize.Net transactions against the configured product prices. Everything up to and including 2.4.2.1 is covered by a separate rule carrying CVE-2026-65880 and CVE-2026-56291. Both of these CVEs are credited to Akinlabi Omoogun; neither was a mySites.guru finding.
Affected versions: ≥ 2.4.3 and < 2.4.3.2
Full advisory: www.cve.org