The Balbooa Forms extension for Joomla supports administrator-defined PHP code execution after public form submissions. This feature allows embedding form-field shortcodes inside the PHP code. However, before executing the code with eval(), the extension replaces each shortcode with the raw user-submitted value without proper sanitization. This leads to a code injection vulnerability (CWE-94) that can be exploited by an unauthenticated attacker who crafts a form submission containing malicious shortcode content. The vulnerability affects versions from 1.0.0 up to and including 2.4.3.3. The CVSS 4.0 base score is 9.5, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can achieve remote code execution on the server hosting the vulnerable Balbooa Forms extension by submitting specially crafted form data. This can lead to full compromise of the affected Joomla installation, including data theft, service disruption, or further pivoting within the network. The vulnerability has a critical CVSS score of 9.5, reflecting its high impact and ease of exploitation.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable the PHP-after-submission feature or avoid using form-field shortcodes inside administrator-defined PHP code in Balbooa Forms. Monitor for vendor updates and apply official patches promptly once released.