The Balbooa Forms component for Joomla contains an improper control of code generation (CWE-94) vulnerability that enables unauthenticated attackers to execute arbitrary code remotely. The issue arises from insecure handling of forms that include the signature field type in versions prior to 2.4.3. No official remediation or patch information is provided in the available data.

Successful exploitation can lead to remote code execution without authentication, potentially allowing attackers to fully compromise affected Joomla installations running vulnerable versions of Balbooa Forms. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor balbooa.com or Joomla advisories for updates. Until a fix is available, consider disabling or removing the vulnerable Balbooa Forms component or restricting access to forms with the signature field type.