The Tassos Framework plugin incorrectly processes certain AJAX requests via Joomla’s com_ajax entry point. When an attacker crafts the right input, internal functions can be invoked without proper authentication checks, allowing them to inject SQL commands and read files that should be protected. This flaw gives attackers direct access to database contents and sensitive file data, compromising both confidentiality and integrity.

Vulnerable products include Tassos Framework (plg_system_nrframework) and its bundled extensions: Advanced Custom Fields, Convert Forms, EngageBox, Google Structured Data, and Smile Pack. The flaw exists in all releases from version 4.10.14 up to 6.0.37 inclusive.

With a CVSS score of 9.5, the issue is considered critical, but current EPSS indicates low exploitation probability (<1%). The vulnerability is not yet listed in CISA’s KEV catalog. Attackers can send crafted AJAX requests to the com_ajax endpoint from any web client, bypassing authentication (CWE‑284). No local privileges are required; remote unauthenticated execution leads to full SQL injection and file read capabilities.