This vulnerability, classified as CWE-602, allows attackers to bypass client‑controlled CAPTCHA and field validation in the Convert Forms extension for Joomla. By manipulating form data on the client side, an attacker can submit arbitrary fields or data that bypasses the expected restrictions, potentially leading to the submission of harmful or unwanted content. The impact centers on the integrity of form submissions, with the potential to submit data that was not intended or approved by the site owner.

The Convert Forms extension for Joomla provided by tassos.gr is affected in versions 1.0.0‑4.4.16 and 5.0.0‑5.2.5. These versions allow a client‑controlled validation bypass that permits manipulation of both CAPTCHA and field validation logic.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of < 1% suggests a low exploitation probability, and the issue is not listed in the CISA KEV catalog. An attacker can exploit the bypass by submitting crafted form data through the extension’s public forms, requiring no special privileges or credentials. Given the ease of exploitation and the potential for data misuse, the risk of abuse is significant.