CVE-2026-49049

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

CVSS 7.5 HIGHEPSS 0.2%CWE-284

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

29 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

joomshaper.com · Helix3 extension for Joomla

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.joomshaper.com/