A vulnerability labeled as critical has been found in Tassos Novarain, Framework, Convert Forms, EngageBox, Google Structured Data, Advanced Custom Fields and Smile Pack. The impacted element is an unknown function of the component com_ajax. The manipulation results in improper access controls.
This vulnerability is reported as CVE-2026-21627. The attack can be launched remotely. No exploit exists.
