CVE-2026-49049CWE-284

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

High · published June 29, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00992 · 62.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-06-29T14:34Z
EPSS history
Timeline
  • 29 JUN 14:34Z
    Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
    cvelistv5