CVE-2026-65883Disclosure(aimy-extensions / aimy_captcha-less_form_guard)

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch aimy-extensions aimy_captcha-less_form_guard systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.

aimy-extensions CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

https://www.aimy-extensions.com/joomla/captcha-less-form-guard.html

Weakness type (CWE)

CWE-502

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

aimy_captcha-less_form_guard

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
6 mentions across 5 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 2 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 6 signals
Disclosure: 2 classified signals
Disclore: 1 classified signal
Peaked 3d ago at 2 mentions (2026-07-31); latest day: 1
6 total mentions across 5 days

Affected systems

Vendors

aimy-extensions

Products

aimy_captcha-less_form_guard

Deep dive

Activity timeline6 mentions / 5d

Signal classification5 categories

Disclosure

233.3%

Disclore

116.7%

Patch

116.7%

PoC

116.7%

General

116.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-29	1	Disclore1
2026-07-31	2	Disclosure1Patch1
2026-08-03	1	PoC1
2026-08-07	1	Disclosure1
2026-08-10	1	General1

Full discourse6 posts

ʞʞıdɐɔoɥƆ@Chocapikk_89d
Disclosure
Disclosed CVE-2026-65883: unauthenticated PHP object injection in Aimy Captcha-Less Form Guard for Joomla. A repeating-key XOR published with its own ciphertext turns every protected form into an unserialize() sink, chaining to RCE on Joomla 3.9-5.2.1 @VulnCheckAI https://www.vulncheck.com/blog/aimy-captcha-less-form-guard-object-injection
Post summary
CVE-2026-65883 is disclosed as an unauthenticated PHP object injection that can chain to RCE on Joomla 3.9-5.2.1, with technical details provided but no PoC, exploit code, or patch mentioned.
0401641.6K
4.1K followersView on X
VulnCheck@VulnCheckAI82d
Disclosure
VulnCheck recently disclosed CVE-2026-65883, a critical unauthenticated PHP object injection vulnerability affecting versions 18.0–20.0 of the Aimy Captcha-Less Form Guard plugin for Joomla. Read more: https://www.vulncheck.com/blog/aimy-captcha-less-form-guard-object-injection
Post summary
VulnCheck announced CVE-2026-65883, a critical unauthenticated PHP object injection flaw in the Aimy Captcha‑Less Form Guard Joomla plugin (v18.0–20.0).
01032964
909 followersView on X
dbugs@ptdbugs87d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-65883 PT ID: PT-2026-65780 Vendor: Joomla Product: Aimy Captcha-Less Form Guard plugin for Joomla (http://aimy-extensions.com) Description: Joomla Extension - http://aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-65780 • https://github.com/shinthink/cve-2026-65883 #dbugs_vuln
Post summary
A proof‑of‑concept exploit for CVE‑2026‑65883—a PHP object injection leading to RCE in the Aimy Captcha‑Less Form Guard plugin for Joomla—has been released on GitHub, but no active exploitation or patch is reported.
00011545
2.7K followersView on X
SecAlerts@SecAlertsCo90d
Patch
💉 PHP object injection via a forged clfgd field = RCE, no auth needed. CVE-2026-65883 hits Aimy Captcha-Less Form Guard 18.0-20.0 on Joomla. CVSS 10. Patch or pull the extension now. #cybersecurity #ciso #vulnerabilities #msp https://secalerts.co/vulnerability/CVE-2026-65883?utm_campaign=x https://t.co/hFhHug2wHS
Post summary
The tweet reports a critical RCE via PHP object injection in Aimy Captcha‑Less Form Guard for Joomla (CVE‑2026‑65883), providing technical details and urging users to patch immediately.
00010155
872 followersView on X
ゆぅさん@YY2042427780d
General
【3軸解説】「Aimy-extensionsのAimy Captcha-less Form Guardにおける信頼できないデータのデシリアライゼーションに関する脆弱性（CVE-2026-65883）」を、背景 / 目的 / 効果の 3 軸で読み解きます。背景/目的/効果の3軸で読み解きました。 #セ… ▶ 無料ツール WR-Analysis: https://www.intect-i.jp/tools/wr-analysis/?utm_source=sns&utm_medium=social&utm_campaign=wr_analysis
Post summary
The post provides a brief 3‑axis explanation of a deserialization vulnerability (CVE‑2026‑65883) in Aimy Captcha‑less Form Guard, without mentioning any PoC, exploit code, patch, or evidence of active exploitation.
0000062
837 followersView on X
Upwind Security MDR@UpwindMDR92d
Disclore
🚨Critical - Joomla Aimy Captcha-Less Form Guard PHP Object Injection RCE (CVE-2026-65883) Joomla plugin plg_captcha_aimycaptchalessformguard deserializes attacker-controlled data from a forged clfgd field, enabling PHP object injection. Crafted serialized payloads can trigger gadget chains for remote code execution. Instances not using this plugin aren’t affected. 👉Affected: plg_captcha_aimycaptchalessformguard 18.0-20.0
Post summary
The message announces a new Joomla vulnerability (CVE-2026-65883) describing a PHP object injection that could lead to remote code execution on affected plugin versions.
0000094
274 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	aimy-extensions	aimy_captcha-less_form_guard	-	joomla\!	-

Explore more

Back to dashboard aimy-extensions CVEs aimy_captcha-less_form_guard vulnerabilities

What researchers are saying

CVE-2026-65883

ʞʞıdɐɔoɥƆ[verified]@Chocapikk_Disclosure

CVE-2026-65883 is disclosed as an unauthenticated PHP object injection that can chain to RCE on Joomla 3.9-5.2.1, with technical details provided but no PoC, exploit code, or patch mentioned.

dbugs[verified]@ptdbugsPoC

A proof‑of‑concept exploit for CVE‑2026‑65883—a PHP object injection leading to RCE in the Aimy Captcha‑Less Form Guard plugin for Joomla—has been released on GitHub, but no active exploitation or patch is reported.

ゆぅさん[verified]@YY20424277General

The post provides a brief 3‑axis explanation of a deserialization vulnerability (CVE‑2026‑65883) in Aimy Captcha‑less Form Guard, without mentioning any PoC, exploit code, patch, or evidence of active exploitation.

Upwind Security MDR[verified]@UpwindMDRDisclore

The message announces a new Joomla vulnerability (CVE-2026-65883) describing a PHP object injection that could lead to remote code execution on affected plugin versions.

VulnCheck@VulnCheckAIDisclosure

VulnCheck announced CVE-2026-65883, a critical unauthenticated PHP object injection flaw in the Aimy Captcha‑Less Form Guard Joomla plugin (v18.0–20.0).

SecAlerts@SecAlertsCoPatch

The tweet reports a critical RCE via PHP object injection in Aimy Captcha‑Less Form Guard for Joomla (CVE‑2026‑65883), providing technical details and urging users to patch immediately.