CVE-2026-102425 is a critical (CVSS 10.0) unauthenticated remote code execution flaw in Balbooa Forms, a Joomla extension, in versions before 2.4.3.4. It affects forms that use the optional PHP after submission action with a field shortcode inside a double-quoted string. Update to 2.4.3.4 or later, and audit those forms.
What's affected
The record covers Balbooa Forms before 2.4.3.4. Update to that release or later and confirm it on the vendor's site, since the record links only to the home page.
The record is specific about exposure. A public form must use the optional PHP-after-submission action and place a field shortcode inside a double-quoted PHP string. Sites that never use that action are not in the described condition, though the safest course is still to update.
How to check if you're exposed
This is a Joomla extension, so check inside Joomla.
- In the administrator area, open System, then Manage, then Extensions, and search for Balbooa Forms.
- Read the installed version. The record covers Balbooa Forms before 2.4.3.4.
- Check the files on the server too, since a site can carry a copy of an extension that is disabled but still reachable. Look for the extension's directory under
components.
If you manage many sites, list installed extensions across all of them and compare against this record.
What to do now
- Update the extension to 2.4.3.4 or later. Download it from the vendor, since the record points only to the vendor's home page.
- If you cannot update today, disable or uninstall the extension and remove its public pages from the menu.
- Open each form in the Joomla admin area and check whether it uses a PHP after submission action. Remove the action or rewrite it so no submitted value is placed into PHP code.
- Check your web server and application logs for unusual requests to the extension's pages since the record was published. A log review proves nothing in either direction by itself, but it can show you what to look at next.
- Rescan your inventory afterwards to confirm the vulnerable version is gone from every site.
Why it matters
The component replaces each shortcode with the raw submitted value before passing the string to eval(). Whatever a visitor types is treated as part of the PHP program. That is code injection, filed as CWE-94.
Two design choices combine here. The feature runs administrator-defined PHP at all, and it builds that code by string substitution. A safer pattern is to avoid evaluating dynamic code and to pass data as parameters, never as source text.
The score is 10.0 because the attack is remote, needs no login and has a changed scope. The record does not report exploitation in the wild, and the KEV flag is false.
Quick check
Am I safe if I never use the PHP after submission option?
The record describes the vulnerable setup as one that uses that option with a field shortcode in a double-quoted string. Check every form, and update anyway.
Sources
Last reviewed: 19 October 2026.
