Joomla third-party-extension wave status: the wave crossed from disclosed to evidenced this week — server access logs showing exploitation requests, and 92 planted administrator accounts on one live site

UPDATE · originally covered Joomla third-party-extension vulnerability wave status: the mySites.guru campaign added a new technique class this week — a client-supplied cookie accepted as proof of identity, giving anonymous Super User access (2026-07-26)

the prior weekly recorded this wave broadening beyond file-upload RCE into a cookie-trusted-as-identity auth bypass, with no member yet confirmed exploited in the wild. That changed this week.

A follow-on source-code audit of Balbooa Gridbox, commissioned by the vendor after its earlier authentication-bypass disclosure, found 22 further vulnerabilities in that one component — and the researcher is explicit that the flaw this entry leads on was not among them: "Number 23 is not from the audit. It surfaced alongside the active exploitation" (mySites.guru, 2026-07-29). Its mechanism is a single line of logic: "the registration handler adds the default group to whatever groups the visitor asks for, instead of replacing them. So anyone can register a normal account and place themselves straight into an administrator group." (mySites.guru, 2026-07-29). Chained with an authenticated arbitrary file upload, that becomes end-to-end unauthenticated remote code execution. The affected range is total — the researcher notes that both CNA records "list the affected range as 1.0.0 to 2.20.1, which is every Gridbox release there has ever been up to the fix. And both set the exploit maturity to Attacked with an urgency of Red, which is the CVE record's own way of recording that this is being used against real sites rather than sitting as a theoretical risk." (mySites.guru, 2026-07-29), with the complete fix in Gridbox 2.20.2 (Balbooa, 2026-07-29). Note that 2.20.1 was itself the fix for the prior weekly's cookie-forgery flaw, so a site that patched in response to that disclosure is still exposed to these.

What moves the wave's status is the evidence class rather than the severity. Previous members were disclosed, sometimes with a public proof-of-concept, occasionally KEV-listed later. This one arrives with logs: "we have the server access logs showing the exploitation requests arriving, and connected sites where the accounts are already planted. On one connected Joomla site our rogue admin check is holding 92 planted accounts right now" (mySites.guru, 2026-07-29). Ninety-two planted administrator accounts on a single site is not opportunistic scanning; it is an automated campaign that has already run.

Cadence did not slow. VulnCheck disclosed an unauthenticated PHP object injection in Aimy Captcha-Less Form Guard, where the anti-spam token is deserialized with no signature and the XOR keystream needed to forge it ships in the same page (VulnCheck, 2026-07-30). And mySites.guru reported four vulnerabilities in JoomShaper SP Page Builder — 6.7.1 closes five in total, the fifth being one the discloser states it neither reported nor tested — the sharpest of them being an ORDER BY injection whose only guard is a Joomla anti-CSRF token that Joomla issues to every anonymous visitor — making it effectively pre-authentication SQL injection returning the entire Joomla database, password hashes included (mySites.guru, 2026-07-27).