CVE-2026-76604: CWE-94 Improper Control of Generation of Code ('Code Injection') in fabrikar.com Fabrik extension for Joomla

The Fabrik extension for Joomla, versions up to and including 4.7.3, contains a code injection vulnerability (CWE-94) in its PHP form element. This flaw allows unauthenticated attackers to execute arbitrary code remotely by supplying malicious input to the vulnerable form element. The vulnerability has a CVSS 4.0 base score of 10.0, reflecting its critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No official patch or remediation guidance is currently provided by the vendor, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could lead to complete compromise of the affected Joomla site running the Fabrik extension, including unauthorized remote code execution without authentication. This can result in full system takeover, data loss, or further attacks within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Joomla extension and consider disabling the Fabrik PHP form element if possible to reduce exposure.