CVE-2026-65883 is a critical vulnerability in the Aimy Captcha-Less Form Guard plugin for Joomla, affecting versions 18.0 to 20.0. The vulnerability is due to unsafe deserialization of untrusted data (CWE-502) via a crafted 'clfgd' field, which leads to PHP object injection and remote code execution. The CVSS 4.0 base score is 10.0, reflecting its network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security controls. No official patch or remediation guidance is currently available from the vendor.

An attacker can remotely execute arbitrary code on the server hosting the vulnerable Joomla plugin without authentication or user interaction. This can lead to full system compromise, data theft, service disruption, and further attacks within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to the 'clfgd' field. Avoid exposing the vulnerable service to untrusted networks if possible.