Actively exploited No authentication
CVE-2026-49049
joomshaper.com Helix3 extension for Joomla
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.
CheckOps priority index
4.2/10 Patch within 7 days
Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.
EPSS · today 0.99% higher than 62.6% of CVEs
CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:
Exploited for 116 days 10 Jul 2026
Fixed packages 0 / 0 in open source registries
Exploitation probability EPSS · FIRST
EPSS probability (%)Percentile among all CVEs
Exploitation signals 2 / 5
- KEV catalog (CISA)no
- Exploited in EUVD (ENISA)10 Jul 2026
- Used by ransomwareno
- EPSS above 10 %0.99%
- No account, over the networkyes
What to do
Fix
Apply the vendor’s fix as soon as it is available.
Meanwhile
Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.
Manufacturers (CRA)
Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained
Affected products
Helix3 extension for Joomla
Affected versions - 1.0-3.1.1
Open source packages OSV
Affected libraries according to OSV, with fixed versions.
Timeline
-
Published
-
Exploitation reported (ENISA)