--- schema: 1 kind: vulnerability title: "CVE-2026-65883 — Aimy Captcha-Less Form Guard for Joomla: the anti-spam token is deserialized before any check, and the XOR keystream ships in the same page (CVSS 9.8)" headline: "A Joomla anti-spam plugin hands unserialize() an attacker-controlled object on every public form, reaching code execution on Joomla cores up to 5.2.1" summary: > VulnCheck disclosed CVE-2026-65883 on 2026-07-30, an unauthenticated PHP object injection in the Aimy Captcha-Less Form Guard plugin for Joomla, versions 18.0 through 20.0 and fixed in 20.1. The plugin base64-decodes a hidden form token, runs it through a repeating-key XOR and passes the result straight to unserialize() with no signature and no allowed_classes — and because the plugin renders a ciphertext for that same keystream in every protected form, the key is recoverable and the object forgeable. On Joomla 3.9 through 5.2.1 it chains through a core gadget to remote code execution as the web user. No exploitation is reported, but three other unauthenticated Joomla extension flaws disclosed this year were exploited in the wild and KEV-listed. discovered_at: "2026-08-01T04:31:06Z" event_date: "2026-07-30" run_id: 2026-08-01T0409Z-intel priority: notable immediate_action: null tags: [vulnerabilities, rce, pre-auth, patch-available] regions: [global, europe] sectors: [public-sector] entities: [trend:joomla-extension-file-upload-rce-wave] techniques: [T1190] affected_products: ["Aimy Captcha-Less Form Guard"] cves: - id: CVE-2026-65883 cvss: "9.8" epss: null type: deserialization vector: zero-click auth: pre-auth status: [patch-available] affected: "Aimy Captcha-Less Form Guard 18.0 through 20.0" fixed: "Aimy Captcha-Less Form Guard 20.1" sources: - url: "https://www.vulncheck.com/blog/aimy-captcha-less-form-guard-object-injection" publisher: "VulnCheck" date: "2026-07-30" role: primary closed_sources: [] evidence: - quote: "There is no signature, no allowed_classes, and no integrity check of any kind. The only thing between the request and unserialize() is a repeating-key XOR, and the plugin publishes a ciphertext for that keystream in every form it renders, which makes the keystream recoverable and the object forgeable." publisher: "VulnCheck" - quote: "Reachability is unauthenticated: the captcha runs on public forms, and Joomla's JForm::validate() evaluates every field's rule independently, so the captcha rule fires even when every other field in the form is empty or invalid." publisher: "VulnCheck" - quote: "One footnote on measuring exposure: the captcha only renders on the forms an administrator attached it to, never on a homepage, so the internet-wide scanners that index homepages under-report this one badly." publisher: "VulnCheck" verification: single-source sourcing_note: > Single-source: VulnCheck is the discloser and the reporting route, and no independent second source reports the flaw; the advisory's own timeline records the identifier as published by the Joomla project's CNA on 2026-07-29, so VulnCheck is not the assigning party. The CVSS score, vector, CWE chain, affected range and fixed release are read from the advisory's own structured severity block rather than its prose. The advisory carries a minor internal inconsistency on the fix date — its introduction says 20.1 shipped "the same day as this disclosure" while its structured block gives 2026-07-29 — so this entry cites the structured block's date. The three exploited Joomla extension CVEs referenced for wave context are named by VulnCheck; this entry does not independently re-verify their KEV listings and therefore does not carry them in `cves[]`. confidence: high update_of: null references: [2026-07-26/joomla-gridbox-cookie-forged-super-user-auth-bypass-wave] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: - "Query the Joomla extension inventory of every site you run for Aimy Captcha-Less Form Guard and upgrade any instance below 20.1 — an internet-wide scan will not find these for you, because the plugin only renders on the specific forms an administrator attached it to and never on a homepage." migrated_from: null --- VulnCheck disclosed `CVE-2026-65883` on 2026-07-30 in Aimy Captcha-Less Form Guard, a Joomla anti-spam plugin published by Aimy Extensions (Netzum Sorglos Software GmbH), affecting versions 18.0 through 20.0 and fixed in 20.1 ([VulnCheck, 2026-07-30](https://www.vulncheck.com/blog/aimy-captcha-less-form-guard-object-injection)). The plugin's premise is that it needs no puzzle: instead of a challenge it plants a hidden field named `clfgd` in every protected form and validates it server-side on submit. The handler `onCheckAnswer()` base64-decodes that field, passes it through `XorHelper::crypt()` and hands the result to `unserialize()` before any other check — and, as VulnCheck puts it, "there is no signature, no allowed_classes, and no integrity check of any kind. The only thing between the request and unserialize() is a repeating-key XOR, and the plugin publishes a ciphertext for that keystream in every form it renders, which makes the keystream recoverable and the object forgeable" ([VulnCheck, 2026-07-30](https://www.vulncheck.com/blog/aimy-captcha-less-form-guard-object-injection)). VulnCheck's structured severity block records CVSS 9.8 on `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, with CWE-502 deserialization of untrusted data leading to CWE-94 code injection ([VulnCheck, 2026-07-30](https://www.vulncheck.com/blog/aimy-captcha-less-form-guard-object-injection)). Two mechanics decide the blast radius. Reachability is total: "the captcha runs on public forms, and Joomla's `JForm::validate()` evaluates every field's rule independently, so the captcha rule fires even when every other field in the form is empty or invalid" ([VulnCheck, 2026-07-30](https://www.vulncheck.com/blog/aimy-captcha-less-form-guard-object-injection)) — an attacker does not need to submit a plausible form, only to hit the endpoint. Code execution, by contrast, is conditional on the core version: the gadget VulnCheck's exploit uses is Joomla's own `FormattedtextLogger`, which "fires on Joomla 3.9 through 5.2.1; 5.2.2 hardened it so `FormattedtextLogger::__wakeup` throws before it can run", and the researcher notes that none of the published `phpggc` chains work as-is against a current 5.4 ([VulnCheck, 2026-07-30](https://www.vulncheck.com/blog/aimy-captcha-less-form-guard-object-injection)). The important qualification is that patching the core does not remove the bug: VulnCheck is explicit that "the object injection and the captcha bypass live in the plugin and are present on every version. On a patched core the only missing piece is a working gadget, and any other extension or bundled library on the site can supply one, which puts RCE back on the table" ([VulnCheck, 2026-07-30](https://www.vulncheck.com/blog/aimy-captcha-less-form-guard-object-injection)). No in-the-wild exploitation is reported for this CVE. What justifies acting on it ahead of the routine cycle is the wave it sits in: VulnCheck records that the Joomla CNA published 52 CVEs in 2025 and 132 through July of 2026, and that three of this year's unauthenticated extension bugs — in the JCE editor, SP Page Builder and Page Builder CK, all CVSS 9.8 — "were exploited in the wild and added to both VulnCheck KEV and the CISA KEV" ([VulnCheck, 2026-07-30](https://www.vulncheck.com/blog/aimy-captcha-less-form-guard-object-injection)). A single-request, no-credentials path to code execution in the same ecosystem, with full mechanics now published, is the profile that has been weaponised repeatedly in this wave. The working exploit itself is a module in the discloser's commercial exploit-intelligence product rather than a public proof-of-concept, so the barrier is the published mechanics, not a downloadable script. For Swiss and European municipal and public-sector estates, where Joomla is a common content-management choice, the exposure question is not whether the site is important but whether this plugin is installed. Detection concepts, telemetry class first. In web-server access logs, the observable is a POST carrying the `clfgd` parameter to a form endpoint where the rest of the submission is empty or malformed — a shape that legitimate form traffic does not produce, because a real user submits a filled form and a real bot submitting garbage is what the plugin is supposed to reject rather than deserialize. The plugin writes its own rejection record (`manipulated form: clfgd broken`) when decoding fails, so a run of those log lines from one source is a tuning attempt in progress rather than routine spam. On the host, PHP-process telemetry is the post-exploitation anchor: the web-server user spawning a shell or writing a new PHP file under the web root, and file-creation events in writable Joomla directories outside a deployment window. Hardening: upgrade the plugin to 20.1; keeping Joomla core at 5.2.2 or later removes the specific published gadget but, per the advisory, does not remove the injection primitive itself. **Triage:** exposure cannot be measured from the outside here, and that is the point worth carrying. VulnCheck notes that "the captcha only renders on the forms an administrator attached it to, never on a homepage, so the internet-wide scanners that index homepages under-report this one badly", and that "absence of hits in Shodan or Censys is a property of how those crawlers work here, not a measure of the install base" ([VulnCheck, 2026-07-30](https://www.vulncheck.com/blog/aimy-captcha-less-form-guard-object-injection)). A clean external scan is not evidence of not being affected; the extension inventory is.