CVE-2026-77026

MediumCVSS 6.9

Published: 20/08/2026(UTC)Updated: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

39th percentile - higher than 39% of all known CVEs

Summary

Convert Forms extension for Joomla (versions 1.0.0-4.4.16 and 5.0.0-5.2.5) contains a client-controlled validation bypass vulnerability. CAPTCHA and field validation can be bypassed.

Risk Assessment

An attacker can submit forged data through forms, bypassing CAPTCHA protections, potentially leading to spam or injection of malicious content.

Recommendation

Update Convert Forms to a version later than 4.4.16 (for 4.x branch) or later than 5.2.5 (for 5.x branch).

Other vulnerabilities in Convert Forms

CVE-2026-65758High
Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.

Original NVD description (English source)

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5 - CAPTCHA and field validation bypass.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS