CVE-2026-65883

Received Received - Intake

RCE via PHP Object Injection in Aimy Captcha-Less Form Guard

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Joomla! Project

Description

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-65883

Affected Vendors & Products

Vendor	Product	Version / Range
aimy_extensions	aimy_captcha_less_form_guard	From 18.0 (inc) to 20.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a Remote Code Execution (RCE) flaw in the Aimy Captcha-Less Form Guard Joomla extension versions 18.0 to 20.0. It allows attackers to inject malicious PHP objects via a forged clfgd field, leading to arbitrary code execution on the server.

Detection Guidance

Check Joomla extensions for Aimy Captcha-Less Form Guard versions 18.0 to 20.0. Inspect HTTP requests for a forged clfgd field which may indicate PHP object injection attempts. Monitor for unexpected PHP execution or code injection in web server logs.

Impact Analysis

An attacker could exploit this to take full control of your Joomla site, steal sensitive data, install malware, or use the server for further attacks. The high CVSS score (10.0) indicates severe impact with no authentication required.

Compliance Impact

This RCE vulnerability could lead to unauthorized access and data breaches, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations may face fines, legal action, and reputational damage if exploited.

Mitigation Strategies

Immediately update Aimy Captcha-Less Form Guard to the latest patched version. If an update is unavailable, disable the extension until a fix is released. Review and restrict access to Joomla admin interfaces and web server directories.

Hi! I’m here to help you understand CVE-2026-65883. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70