CVE-2026-76604

CVE-2026-76604 is an unauthenticated remote code execution vulnerability in Fabrik 4.x, a popular PHP form builder for Joomla. The root cause is Fabrik's PHP form element—a feature that allows form administrators to insert arbitrary PHP code that executes when the form processes submissions. This is not a classic injection bug. The PHP element works exactly as designed: it takes user-supplied PHP and executes it server-side. The vulnerability exists because this functionality was exposed to unauthenticated contexts without adequate access controls, allowing any visitor to trigger code execution by submitting a crafted form request. The critical insight for defenders is that this feature class has a documented failure history across multiple form platforms—including Gravity Forms PHP add-ons and Contact Form 7's deprecated PHP functionality. The pattern is consistent: teams build PHP execution elements to give developers flexibility, but the blast radius of any access control failure is total system compromise. The feature is inherently high-risk because the safe version requires discipline that most teams cannot maintain under deadline pressure. Your immediate actions: First, verify whether your Fabrik installation has any PHP elements configured in forms. If it does, disable and remove them immediately—this is not a patch-or-monitor situation. The PHP element should be treated as radioactive regardless of authentication status. Second, audit all form submissions in your logs for patterns indicating exploitation attempts—unusual POST requests to form endpoints with PHP-like payloads in form fields. Third, if you're on a version prior to 4.7.3, upgrade immediately; the fix addresses this vector. For Joomla administrators specifically: Fabrik often runs with elevated database permissions and may have access to other components. Treat any Fabrik compromise as a full Joomla site compromise—rotate all credentials, audit admin accounts, and check for backdoors in other extensions. The broader lesson is that form builders should never expose PHP execution to unauthenticated contexts, and the existence of such features in any extension is a signal to reconsider whether the flexibility is worth the catastrophic failure mode.

Reviewed through automated stages and approved by a human before publication.