The Helix3 plugin for Joomla exposes an ajax handler task

Helix3 is JoomShaper's template framework — the scaffolding under a huge percentage of Joomla themes. Versions 1.0 through 3.1.0 expose an onAjaxHelix3 handler through Joomla's com_ajax dispatcher, which by design will route requests to a plugin's ajax handler for any anonymous visitor. Helix3 assumed Joomla enforced auth; Joomla assumed the plugin did. The result: the save, remove, and template-parameter actions execute before any session token or permission check, letting an unauthenticated attacker write arbitrary JSON files (with path traversal breaking out of the intended layout folder), delete arbitrary files, and overwrite template parameters — which in practice means injecting JavaScript directly into the theme.

The vendor's HIGH (7.5) rating is directionally correct but *understated*. The CVSS vector caps at I:H / A:N / C:N, but in practice arbitrary file write into the template + template-parameter injection is a straight path to stored XSS across every page, and file delete against Joomla's config or index files takes the site offline. Automated botnets are already exploiting this in the wild — the Hacked by antonkill / trenggalek6etar defacement campaigns are Helix3 fingerprints. This deserves an upgrade for exploitation-in-the-wild and the practical RCE-adjacent impact via JS injection.

Why this verdict

• Unauthenticated + network reachable + trivial payload — no PR, no UI, one HTTP POST. The friction audit finds *zero* prerequisite that assumes a prior compromise stage.
• Active exploitation, PoC in the wild. Public scanner and PoC are already weaponized by defacement botnets; EPSS will catch up.
• Role multiplier — public-facing CMS: the chain succeeds on every reachable install. Blast radius per site: stored XSS, defacement, file deletion, credential harvest on admin login. Not fleet-scale — bounded to that host/site.
• Role multiplier — not a high-value-role component. Helix3 is a template framework, not an IdP, hypervisor, CA, PAM, backup, or edge appliance. No path from one compromised Joomla site to domain, tenant, or supply-chain compromise. This is why the CRITICAL floor does not trigger.
• Vendor score understated I:H impact. Availability is also broken (file delete → outage), and JS injection into template params is functionally stored XSS at every request — worth +0.7 above vendor 7.5.

Why not higher?

CRITICAL is reserved for chains that end in fleet, identity, hypervisor, or supply-chain compromise. Helix3 sits on a public-facing content tier; a compromised Joomla instance is a bad day for that site, not the enterprise identity plane. There is also no known unauthenticated RCE primitive — only file write with a .json extension constraint — so the RCE path requires additional chaining.

Why not lower?

Downgrading to MEDIUM would ignore that this is unauthenticated, network-accessible, actively exploited by automation, and has public PoC and scanner code. Any of those four conditions individually would keep it out of MEDIUM; all four together make HIGH the floor.

1. Upgrade Helix3 to 3.1.1 immediately — The only real fix. Log into Joomla admin → Extensions → Manage → Update, or drop the 3.1.1 package manually. Deploy within 3 days per noisgate mitigation SLA given active exploitation.
2. WAF rule blocking com_ajax + plugin=helix3 from unauthenticated sources — As a stopgap while you stage the upgrade, block or challenge any request matching option=com_ajax&plugin=helix3 that doesn't carry a valid admin session cookie. Cloudflare/Akamai/ModSecurity all support this in a single custom rule. Deploy within hours, not days.
3. File integrity monitoring on /templates/ and /plugins/system/helix3/ — Wazuh, OSSEC, or Tripwire alerting on any write/delete under those paths catches both this exploit and its persistence. Enable in parallel with the WAF rule.
4. Audit templates for injected JS in template parameters NOW — Before patching, check params fields in the Helix3 template options for <script>, document.write, eval, or unfamiliar URLs. Patching does not remove already-planted payloads.
5. Rotate admin credentials post-cleanup — If JS injection has been live for any period, assume harvested admin sessions/credentials. Force password reset + invalidate all sessions before re-enabling admin login.

Run this from an auditor workstation against a target site. Invoke as ./check-helix3.sh https://target.example.com. No credentials required — the check probes the same unauthenticated endpoint the exploit uses, then also parses the site HTML for a Helix3 version marker. Requires curl and grep.

#!/usr/bin/env bash
# noisgate verifier: CVE-2026-49049 — Helix3 Joomla unauth ajax handler
# Usage: ./check-helix3.sh https://target.example.com
set -u
TARGET="${1:-}"
if [ -z "$TARGET" ]; then
  echo "usage: $0 https://target.example.com" >&2
  exit 2
fi

UA='noisgate-verifier/1.0 (CVE-2026-49049)'
AJAX_URL="${TARGET%/}/index.php?option=com_ajax&plugin=helix3&format=json"
HOME_URL="${TARGET%/}/"

# 1. Fingerprint Helix3 presence
HTML=$(curl -s -A "$UA" -L --max-time 15 "$HOME_URL" || true)
if ! echo "$HTML" | grep -qiE 'helix3|sp-page|sp_helix'; then
  echo "UNKNOWN: no Helix3 fingerprint on $TARGET"
  exit 3
fi

# 2. Probe unauthenticated ajax handler with a benign action.
#    A patched (3.1.1+) install rejects unauthenticated calls; vulnerable
#    installs return a JSON response from the handler itself.
RESP=$(curl -s -A "$UA" -L --max-time 15 \
  -H 'X-Requested-With: XMLHttpRequest' \
  --data 'action=noisgate_probe' \
  "$AJAX_URL" || true)

# Patched builds should return an authorization error or a 403.
HTTP_CODE=$(curl -s -A "$UA" -L --max-time 15 -o /dev/null -w '%{http_code}' \
  -H 'X-Requested-With: XMLHttpRequest' \
  --data 'action=noisgate_probe' \
  "$AJAX_URL" || true)

if [ "$HTTP_CODE" = "403" ] || echo "$RESP" | grep -qiE 'not authoriz|forbidden|access denied|invalid token'; then
  echo "PATCHED: Helix3 fingerprint present but ajax handler rejects unauthenticated calls ($TARGET)"
  exit 0
fi

if echo "$RESP" | grep -qiE '"success"|"data"|"message"|helix3'; then
  echo "VULNERABLE: unauthenticated onAjaxHelix3 handler responded on $TARGET"
  echo "  → upgrade Helix3 to 3.1.1 immediately (CVE-2026-49049)"
  exit 1
fi

echo "UNKNOWN: inconclusive response (HTTP $HTTP_CODE) — manual review required"
exit 3

Sources

1. GitHub Advisory GHSA-xr7r-292v-jxg8
2. JoomShaper Helix3 3.1.1 changelog (mySites.guru)
3. IONIX threat center writeup
4. VulDB CVE-2026-49049
5. Public scanner (shinthink/CVE-2026-49049)
6. Sploitus exploit entry
7. HTProtect.org update guide
8. AntonKill defacement analysis