The Fabrik extension for Joomla, versions 1.0.0 up to and including 4.6.7, contains an unauthenticated remote code execution vulnerability (CWE-94) in the frontend listfilter model. An attacker can exploit this flaw to execute arbitrary code on the affected system without authentication, posing a critical security risk. The vulnerability is identified as CVE-2026-67282 and has a CVSS 4.0 score of 10.0, indicating maximum severity with network attack vector, no required privileges, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No official patch or remediation level is currently documented in the vendor advisory or CVE data.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely on the affected Joomla system running the vulnerable Fabrik extension. This can lead to full system compromise, data loss, or further attacks within the environment. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Joomla extension and consider disabling the Fabrik extension if feasible. Monitor vendor channels for updates and apply patches promptly once available.