CVE-2026-67364

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.2

Description An unauthenticated attacker can perform PHP code injection due to the use of the eval() function in the optional custom-PHP post-submission handler. The [URL parameter = X] shortcode is replaced with the raw, unescaped value of a query parameter, allowing arbitrary PHP code to execute on the server. Although a CSRF (Cross-Site Request Forgery) token is required to access the endpoint, it is disclosed anonymously through a separate task. This issue is exploitable if the form has a custom-PHP handler configured that references the shortcode and does not use reCAPTCHA on the submit button.

Recommendations Update to version 2.4.3.2 or later. As a temporary mitigation, disable the custom-PHP post-submission handler or implement reCAPTCHA on the submit button.