The extension allows developers to specify a custom PHP handler that is executed through eval() when a form is submitted. An attacker can supply a query parameter that is substituted into the shortcode, resulting in arbitrary PHP being evaluated on the server. This gives a remote code execution capability, enabling complete compromise of the Joomla site, and therefore the impact is loss of confidentiality, integrity and availability for all affected assets.

The vulnerability affects Balbooa Forms extensions for Joomla versions older than 2.4.3.2. The product is provided by balbooa.com. No other vendors or versions are listed.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of < 1% suggests a very low but non‑zero probability of exploitation in the wild, likely due to the lack of authentication and the publicly disclosed CSRF token that can be retrieved via a separate task, which allows an attacker to construct a valid request. Because the flaw is triggered server‑side, a remote attacker can successfully execute arbitrary PHP code if the form has a custom PHP handler referencing the vulnerable shortcode and the submit button has no reCAPTCHA protection. The risk is hence high for sites using Balbooa Forms < 2.4.3.2 that have such a configuration. The vulnerability is not listed in the CISA KEV catalog.