Vulnerability · Published Jun 29, 2026 · Assigned by Joomla
CVE-2026-49049Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
High 7.5
In plain English
A high-severity improper access control in Helix3 extension for Joomla from joomshaper.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 37.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC
Official description
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| joomshaper.com | Helix3 extension for Joomla | 1.0-3.1.1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://www.joomshaper.com/ product