A critical remote code execution vulnerability in the Fabrik extension for Joomla allows unauthenticated attackers to execute arbitrary code on the host server.

This vulnerability is a code injection flaw, categorized under CWE-94, occurring within the PHP form element. The application fails to properly sanitize user provided input, enabling an unauthenticated attacker to inject and execute arbitrary PHP code.

Successful exploitation grants an attacker full control over the underlying server, leading to complete data exfiltration, service disruption, or the potential for lateral movement within the network. Given the CVSS score of 10.0, this represents the highest level of risk, as the vulnerability is remotely exploitable without requiring authentication or user interaction.

Immediate Action: Update the Fabrik extension for Joomla to version 4.7.4 or later immediately to address the underlying injection flaw.

Proactive Monitoring: Monitor server logs for suspicious PHP execution patterns or unexpected modification of files within the web directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious PHP syntax or unauthorized code execution attempts.

Public Exploit Available: Unknown

This vulnerability poses an extreme risk to the integrity and availability of the affected environment. Administrators must prioritize updating the Fabrik extension to the latest version to eliminate this critical vector for remote code execution.