A critical access control and information disclosure vulnerability in the Tassos Convert Forms extension for Joomla enables unauthorized access to sensitive data.

The vulnerability stems from improper access control (CWE-284) and the exposure of sensitive information (CWE-200). An unauthenticated remote attacker can exploit these flaws to access form data or internal configuration details that should be restricted.

The CVSS score of 8.2 reflects the high risk posed to data privacy and regulatory compliance. Unauthorized access to form submissions can lead to the compromise of customer personal identifiable information (PII) or other sensitive business intelligence. Such an event would likely result in significant compliance penalties and loss of customer trust.

Immediate Action: Review the Tassos website for security updates and upgrade the Convert Forms extension to the latest available version.

Proactive Monitoring: Inspect form submission logs for anomalous activity and audit access logs to identify attempts to retrieve unauthorized data.

Compensating Controls: Implement strict firewall rules and, if possible, restrict administrative or front-end access to the extension until a patch is applied.

Public Exploit Available: Unknown

Users of the Convert Forms extension should verify their current version and update immediately upon the release of a security patch. Until then, evaluate the necessity of the extension and consider temporary deactivation if the risk of data exposure outweighs the operational utility of the form system.