Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
78Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.5epss 1.0%
from disclosure to weapon5 days
Published on NVDJun 29
1st PoC+5d
VulnCheck+43d
exploitation probability
1.0%top 40% of all CVEs
observed exploitation
yesVulnCheck
8 public exploit(s)
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
joomshaper.com · Helix3 extension for Joomlapublic PoCs found — 8
githubgithub.com/shinthink/CVE-2026-49049★ 4githubgithub.com/Jenderal92/CVE-2026-49049★ 1githubgithub.com/Dr-D25/CVE-2026-49049★ 0githubgithub.com/ExDev994/CVE-2026-49049★ 0githubgithub.com/frada321/asdsadsadasdasdsadsad★ 0vulncheckvulncheck.com/xdb/b4600071f8d9unverifiedvulncheckvulncheck.com/xdb/9b09e0f5fd1dunverifiedvulncheckvulncheck.com/xdb/418f4dc859d2unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://www.joomshaper.com/