Balbooa Joomla Forms Builder 2.0.6 has an unauthenticated SQL injection flaw in the form submission handler that lets attackers send crafted POST requests with malicious JSON in the 'id' field. This flaw allows execution of arbitrary SQL queries, enabling extraction or modification of sensitive database contents. The vulnerability is classified as CWE‑89, a classic SQL injection weakness.

Balbooa Joomla Forms Builder version 2.0.6.

The CVSS score of 8.8 indicates high severity, while the lack of an EPSS score and the absence from CISA KEV suggest the exploit is not well documented yet but remains possible. Because authentication is not required to reach the vulnerable endpoint, an attacker can readily abuse the flaw once the component is exposed on a web server, leading to potential data theft or database tampering.