Convert Forms (com_convertforms) 4.4.10 to 4.4.15 (Joomla 3 branch) - Unauthenticated Submission Disclosure
Tracked as CVE-2026-65758 (Joomla CNA, published 23 July 2026, CVSS 4.0 8.2 High, CWE-200/CWE-284). Convert Forms by Tassos did not enforce access control on the front-end Submissions view, so an unauthenticated visitor could list the submissions sent through a form - exposing whatever that form collects, typically names, email addresses and message bodies. Tassos fixed the flaw separately on each release branch. This rule covers the Joomla 3 branch: 4.4.11 through 4.4.16 are Joomla 3.8/3.9/3.10 only builds, and the fix shipped in 4.4.16 on 27 July 2026. Update to Convert Forms 4.4.16. The floor is 4.4.10 because everything below it is flagged by the separate Convert Forms rule. Sites on Joomla 4, 5 or 6 run the 5.x branch instead, where the same flaw was fixed in 5.2.3 - see the companion rule.
Affected versions: ≥ 4.4.10 and < 4.4.16
Full advisory: www.tassos.gr
Convert Forms (com_convertforms) below 4.4.10 - Unauthenticated Arbitrary File Upload (RCE), Reflected XSS and Authenticated SQL Injection
Convert Forms by Tassos Marinos. CVE-2024-40744 (unauthenticated arbitrary file upload leading to RCE, fixed in 4.4.8), CVE-2024-40745 (reflected XSS, fixed in 4.4.8) and CVE-2025-22212 (authenticated SQL injection in the submission management area, affects 1.0.0-4.4.9). Update to 4.4.10 or later (current line is 5.x).
Affected versions: < 4.4.10
Full advisory: nvd.nist.gov
Convert Forms (com_convertforms) 5.0.0 to 5.2.2 (Joomla 4/5/6 branch) - Unauthenticated Submission Disclosure
Tracked as CVE-2026-65758 (Joomla CNA, published 23 July 2026, CVSS 4.0 8.2 High, CWE-200/CWE-284). Convert Forms by Tassos did not enforce access control on the front-end Submissions view, so an unauthenticated visitor could list the submissions sent through a form - exposing whatever that form collects, typically names, email addresses and message bodies. Tassos fixed the flaw separately on each release branch. This rule covers the 5.x branch, which targets Joomla 4, 5 and 6. The fix shipped in 5.2.3 on 22 July 2026; update to 5.2.4 or later, because 5.2.3 carries the fix but introduced a fatal error in the File Upload field that 5.2.4 corrects. Sites on Joomla 3 run the 4.4.x branch instead, where the same flaw was fixed in 4.4.16 - see the companion rule.
Affected versions: ≥ 5.0.0 and ≤ 5.2.2
Full advisory: www.tassos.gr
Convert Forms (com_convertforms) 5.2.3 to 5.2.4 (Joomla 4/5/6 branch) - Unauthenticated Client-Controlled Validation Bypass (CAPTCHA and field validation bypass, CVE-2026-77026)
Convert Forms 5.2.3 and 5.2.4 on the Joomla 4/5/6 branch let an unauthenticated visitor bypass CAPTCHA and other field validations by claiming the fields were hidden by Conditional Logic. Because the form decides which validation rules apply on the client side, a crafted submission can assert that a required or CAPTCHA-protected field was conditionally hidden and skip its validation entirely. The practical impact is spam and unvalidated data reaching your forms, your notification emails and any downstream integrations. It does not expose existing submissions. Tassos Marinos fixed it in Convert Forms 5.2.5, released 20 August 2026. Update to 5.2.5 or later. Sites on the Joomla 3 branch need 4.4.17 instead, which carries the same fix. CVE-2026-77026, CVSS 4.0 base 6.9 Medium (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L), credited to Murrez. Note: the published CVE description text actually describes an earlier and different flaw, unauthorised front-end viewing of form submissions, which was fixed back in 5.2.3 and is covered by a separate rule. The CVE title, its affected version range and its CVSS vector all match this validation bypass rather than that disclosure.
Affected versions: ≥ 5.2.3 and < 5.2.5
Full advisory: www.tassos.gr
Convert Forms (com_convertforms) 4.4.16 (Joomla 3 branch) - Unauthenticated Client-Controlled Validation Bypass (CAPTCHA and field validation bypass, CVE-2026-77026)
Convert Forms 4.4.16 on the Joomla 3 branch lets an unauthenticated visitor bypass CAPTCHA and other field validations by claiming the fields were hidden by Conditional Logic. Because the form decides which validation rules apply on the client side, a crafted submission can assert that a required or CAPTCHA-protected field was conditionally hidden and skip its validation entirely. The practical impact is spam and unvalidated data reaching your forms, your notification emails and any downstream integrations. It does not expose existing submissions. Tassos Marinos backported the fix to the Joomla 3 branch in Convert Forms 4.4.17, released 21 August 2026, one day after the 5.2.5 release on the Joomla 4/5/6 branch. Update to 4.4.17. CVE-2026-77026, CVSS 4.0 base 6.9 Medium (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L), credited to Murrez. Note: the published CVE description text actually describes an earlier and different flaw, unauthorised front-end viewing of form submissions, which was fixed on this branch in 4.4.16 and is covered by a separate rule. The CVE title, its affected version range and its CVSS vector all match this validation bypass rather than that disclosure.
Affected versions: ≥ 4.4.16 and < 4.4.17
Full advisory: www.tassos.gr
Running Convert Forms on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
CVE identifiers: CVE-2026-65758, CVE-2024-40744, CVE-2024-40745, CVE-2025-22212, CVE-2026-77026. Rules current as of 13 September 2026.