Security
Critical Astroid Framework flaw is under active exploitation
JoomDev's Astroid Framework for Joomla is affected by a critical authentication bypass that attackers are actively using to upload backdoors and inject SEO spam.
Research published by mySites.guru identifies the issue as CVE-2026-21628, rated CVSS 10.0 Critical and classified as CWE-434, unrestricted upload of a file with a dangerous type. The flaw affects every Astroid Framework version before 3.3.11, including installations on Joomla 5 and Joomla 6.
The vulnerable administrative AJAX handling accepted a CSRF token without confirming that the requester was an authenticated administrator. As a result, attackers could send requests without logging in and upload files or install extensions. Observed attacks have installed malicious BLPayload system plugins and hidden SEO links.
Administrators should update to Astroid Framework 3.3.13. Version 3.3.11 introduced the security fix, while 3.3.12 addressed regressions; 3.3.13 is the recommended release. On potentially compromised sites, updating alone is not sufficient.
- Search the Joomla plugin manager for
BLPayloadorBL Payload. - Remove suspicious
plg_jcp_*.htmlfiles from/administrator/cache/and investigate other backdoors. - Run a full audit and change Joomla, database, FTP and hosting credentials.
Originally reported by mySites.guru.