The Helix3 plugin for Joomla exposes an AJAX handler task that lacks proper access control, enabling unauthenticated attackers to perform unauthorized actions such as deleting arbitrary files, writing arbitrary JSON files, and updating template parameters. This vulnerability is classified under CWE-284 (Improper Access Control) and affects Helix3 versions from 1.0 up to and including 3.1.1. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker can exploit this vulnerability remotely without authentication to modify or delete files arbitrarily and update template parameters, potentially compromising the integrity of the affected Joomla website. This could lead to unauthorized changes in website behavior or content, impacting the trustworthiness and stability of the site. There is no reported impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected AJAX handler if possible, and monitor for suspicious activity related to file deletions or template modifications. Avoid exposing the vulnerable Helix3 extension to untrusted networks.