CVE-2026-65883 is a critical (CVSS 9.8) PHP object injection flaw in Aimy Captcha-Less Form Guard for Joomla, versions 18.0 to 20.0. A forged form field can lead to remote code execution. The fixed version is not confirmed in the pages I read, so check the vendor's notes before updating.
What's affected
- Product: Aimy Captcha-Less Form Guard, a Joomla system plugin that checks form submissions for spam.
- Affected versions: 18.0 to 20.0, per the Joomla CNA record.
- Fixed version: not confirmed. The vendor page lists 20.4 as the current release, and its news item for 20.4 mentions only an RSForm bug fix, so the advisory should be checked.
- Weakness: CWE-502 deserialization of untrusted data.
- Severity: CVSS 3.1 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No account is needed.
How to check if you're exposed
In the Joomla administrator, open System, then Manage, then Extensions, and search for Captcha-Less Form Guard to see the installed version. You can also read it from the plugin manifest on disk:
grep -i '<version>' /path/to/site/plugins/system/*/*.xml | grep -i -E 'clfg|captcha'
Plugin folder names vary, so adjust the path if nothing comes back. Check every Joomla site you host, not only the main one, and check whether the plugin is enabled. If you run it for forms such as contact or registration pages, those pages are the exposed surface.
What to do now
- Find every Joomla site that has the plugin installed and record the version.
- Open the vendor page and release notes, and update to the newest release.
- If you cannot confirm a fix, disable the plugin and use another spam control until the vendor confirms one.
- Review the site for unfamiliar PHP files and new administrator accounts.
- Check web server logs for unusual POST requests to form pages.
Why it matters
PHP object injection happens when a program turns attacker supplied text back into PHP objects. If the application has classes whose methods do something dangerous when they are created or destroyed, a crafted value can trigger those methods. The record says a forged form field is enough, with no account.
The plugin sits in front of public forms by design, which makes the surface wide. The CISA KEV flag is false and the record does not report exploitation. Because an anti spam plugin runs on every form, an unpatched copy is worth removing quickly.
Quick check
Which version is safe?
I could not confirm one. The vendor page shows 20.4 as current but does not tie it to this CVE. Ask the vendor or read the release notes before you rely on it.
Can I just disable the plugin?
Yes, that removes the exposure while you wait. Joomla forms will lose this spam check, so put another control in place.
Sources
Last reviewed: 19 October 2026.
