Hackers Are Breaking Into Websites Through Two Popular Joomla Add-Ons
Two widely used plugins for the Joomla website-building platform have critical security flaws that let criminals take full control of a site without needing a password. Patches exist, but attacks started before most site owners knew there was a problem.
Key points
- CVE-2026-56291, the Balbooa Forms flaw, carries a perfect 10-out-of-10 severity score and was being actively exploited before a patch was released on 9 July 2026.
- CVE-2026-48939 is a matching flaw in the iCagenda events calendar plugin, also scored 10, and exploited as a zero-day from 15 June 2026; the developer patched it on 15 and 16 June.
- Both flaws let criminals upload malicious code to a website without logging in, then run that code to take over the server.
- CISA added both flaws to its Known Exploited Vulnerabilities catalog on 10 July 2026, ordering federal agencies to patch within three days.
- Every organisation running either plugin should treat that deadline as their own, not just government bodies.
Joomla is a free content management system, software that lets businesses build and run websites without writing code from scratch. Millions of sites use it. Like most such platforms, it supports plugins, small add-on programs that extend what the main software can do.
Two of those plugins have become the entry point for a wave of attacks.
Balbooa Forms adds contact forms and file-upload features to a Joomla site. ICagenda is a popular events calendar. Both contain what researchers call an arbitrary file upload vulnerability: a criminal sends a specially crafted file through a normal-looking upload button, and the server accepts it without checking whether it's safe.
The file they upload is PHP code, a type of programming instruction the web server then executes. Once that code is running, the attacker has remote code execution and can do almost anything: steal data, delete content, redirect visitors to scam pages, or recruit the server to attack other targets. Neither flaw requires a password.
Should website owners be worried?
Yes, immediately, if they haven't already patched. JoomliC, iCagenda's developer, spotted live attacks on 15 June 2026 and pushed fixes across versions 4.0.8 and 3.9.15 on 15 and 16 June. Balbooa released its fix, version 2.4.1, on 9 July 2026. Any site still on an older version of either plugin is exposed right now.
The failure mode here is familiar to anyone who's written a post-mortem: both bugs were already being weaponised when the patches dropped, so detection and rapid response mattered more than prevention. As our earlier story on the Australian Cyber Security Centre's warning about Joomla site hijackings showed, these campaigns tend to hit small businesses hardest, the organisations least likely to have someone watching server logs at 2 a.m.
CISA, the US cybersecurity agency, added both flaws to its Known Exploited Vulnerabilities catalog on 10 July 2026, as first reported by SecurityWeek. Federal agencies face a three-day patch deadline under BOD 26-04 guidance. Everyone else should move just as fast.
If you manage a Joomla site, open your plugin manager now and check version numbers on both Balbooa Forms and iCagenda. If you're a visitor seeing unusual redirects or strange pop-ups on a Joomla-powered site, it may already be compromised.
Update the plugin. Then check your logs.
