CVE-2026-66488 is a security vulnerability in the balbooa.com Gridbox extension for Joomla that permits bypassing payment mechanisms in versions from 1.0.0 up to and including 2.20.1. The vulnerability was publicly disclosed without an associated CVSS score or detailed technical exploit information. No vendor advisory or patch information is currently available, and no known active exploitation has been reported.

The vulnerability enables attackers to bypass payment controls within the affected Gridbox extension versions, potentially allowing unauthorized access to paid features or services without completing payment. This could lead to financial loss or unauthorized use of premium functionalities in Joomla sites using this extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected Gridbox extension versions or implementing compensating controls to prevent unauthorized payment bypass. Monitor official balbooa.com and Joomla security advisories for updates.