Security Update: CAPTCHA and Field Validation Bypass in Convert Forms

On August 8th, 2026, a client-controlled validation bypass in Convert Forms was disclosed to us by a security researcher, and reported in parallel to the Joomla Security Strike Team for CVE coordination.

The issue is tracked as CVE-2026-77026.

We reviewed the code, stopped the server from trusting the browser on this point, and shipped a patched version. The issue is fully resolved in Convert Forms 5.2.5.

What was the issue?

Convert Forms has a Conditional Logic feature. It shows and hides fields while the visitor fills the form, based on the answers given. A field that is hidden must not be validated, because the visitor was never given the chance to fill it. Otherwise a hidden required field would block every submission.

To make that work, the browser posted a list of the fields that Conditional Logic had hidden, together with the rest of the form data. The server read that list and skipped those fields.

The problem is that the list came from the browser, and the server took it at face value. Anyone can put whatever they like in a form post. A crafted request could name any field on the form, and the server would skip that field's checks: whether Conditional Logic had really hidden it or not, and whether the form used Conditional Logic at all.

The checks that could be skipped included:

• CAPTCHA fields: Captcha, reCAPTCHA, hCaptcha, Cloudflare Turnstile and ALTCHA
• Required fields, including the Terms of Service consent checkbox
• Format checks, such as email address, URL, number range, length limits and character restrictions

In practice, this let a script submit a form without solving the CAPTCHA and without filling in the fields you marked as required. The submission was then treated as valid: it was saved, notification emails went out, and every Task on the form ran, such as creating an article, subscribing an address to a list, or calling a webhook.

Two limits are worth stating clearly. First, a field named in that list was skipped completely, so its value was not saved. The trick removed checks, it did not inject data. Second, the checks that run on the form as a whole still ran on every submission, so the Honeypot and Time to Submit anti-spam rules were never bypassed.

We have no reports or evidence that this was used against a live site. The report was never made public before the fix.

What we changed

The server no longer takes the browser's word for it. It now asks the Conditional Logic plugin which fields this particular form is able to hide, and keeps only the fields that appear in both lists. Everything else is validated as normal. If Conditional Logic is disabled, or the form has no rule that hides a field, every claim is rejected.

The same untrusted list also decided which fields to leave out of the {submission.fields --excludehiddenbylogic} Smart Tag in emails and PDFs. That now uses the server-approved list too.

Who is affected?

This one is specific to Convert Forms. It lives in the component itself, not in the shared Tassos Framework plugin, so no other Tassos extension is affected by it.

Your site is affected if both of the following are true:

• You run Convert Forms 2.7.5 up to and including 5.2.4 on Joomla 4, 5 or 6, or any version up to and including 4.4.16 on Joomla 3. Version 2.7.5 is where the field-skipping behaviour was introduced
• You have at least one published form that a visitor can reach, through a menu item, a module, a plugin or a shortcode

Your form does not need to use Conditional Logic. The server accepted the claim on any form.

We rate the impact as moderate. It defeats your spam and consent controls, and it lets automation drive whatever your form does next. It does not expose stored submissions, and it does not allow code execution.

What you need to do

Update Convert Forms to the version below, or later.

Verify your installation

After updating, confirm you are running a patched version:

1. Log in to your Joomla Administrator
2. Go to System → Manage → Extensions
3. Search for Convert Forms and confirm the version is 5.2.5 or later

If it is, you are protected.

If you cannot update right away

There is no setting that closes this one, so updating is the real fix. If you need to buy yourself some time, unpublish the forms that matter most until you can update, starting with any form that sits behind a CAPTCHA, collects consent, or runs a Task that creates content, sends mail or calls an external service.

1. Log in to your Joomla Administrator
2. Go to Components → Convert Forms → Forms
3. Unpublish the forms in question, or remove the menu item, module or shortcode that publishes them

Keep in mind that this also takes those forms away from your visitors, so treat it as a temporary measure.

Should you check anything else?

There is no reliable way to tell from the outside whether anyone used this on your site, because the requests look like ordinary form submissions. What you can do is look at the result rather than the request.

Open Components → Convert Forms → Submissions and look for:

• A jump in the number of submissions that you cannot explain
• Submissions where a field you marked as required is empty
• Submissions on a form that has a CAPTCHA, arriving faster or in larger numbers than your visitors could produce

If you find spam, delete it as usual. If you find something that worries you, open a support ticket and we will help you make sense of it.

Responsible disclosure

Our thanks to the researcher who reported this to us responsibly, and who supplied a detailed reproduction package that made it quick to confirm. Thanks also to the Joomla Security Strike Team for coordinating the disclosure.

If you believe you have found a security issue in one of our extensions, please open a support ticket and tell us what you found. We treat these reports as a priority, we keep you informed while we work on a fix, and we credit reporters in the release notes.

Security remains a top priority for us. If you need help updating, or you have any questions about this update, open a support ticket and we will assist you promptly.