CVE-2026-65883 is a critical vulnerability in the Aimy Captcha-Less Form Guard Joomla plugin (versions 18.0 to 20.0) that allows remote code execution through PHP object injection. The flaw is due to unsafe deserialization of untrusted input in the 'clfgd' field, enabling attackers to execute arbitrary code on affected systems without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, and no user interaction needed, with high impact on confidentiality, integrity, availability, and security requirements. No vendor-provided patch or official remediation is currently documented.

Successful exploitation results in remote code execution on the affected Joomla server, allowing attackers to fully compromise the system, potentially leading to data theft, service disruption, or further network penetration. The vulnerability requires no privileges or user interaction, making it highly exploitable remotely. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the affected plugin versions (18.0 through 20.0) to prevent exploitation. Monitor official channels from aimy-extensions.com and Joomla for updates and apply patches promptly once available.