CVE-2026-102425

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4

Description An unauthenticated remote code execution (RCE) issue exists in the com baforms component. The software allows administrators to define PHP code that executes after a public form submission, which supports the use of form-field shortcodes. The component fails to properly sanitize these shortcodes before passing them to the eval() function, replacing them with raw values submitted by the visitor. This allows an attacker to execute arbitrary code if a public form utilizes the optional PHP-after-submission action and interpolates an attacker-controlled field shortcode within a double-quoted PHP string.

Recommendations Update to version 2.4.3.4 or later.