# CVE-2026-66488: Balbooa Gridbox payment bypass in Joomla extension

Source: https://junglewise.ai/threats/cve-2026-66488-balbooa-gridbox-payment-bypass-in-joomla-extension  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-66488 · Severity: info · CVSS 7.5 · Published 2026-07-29

A vulnerability in the Gridbox page builder for Joomla allows unauthorized users to bypass payment processes. Gridbox is a popular tool used to build websites, online stores, and booking systems. An attacker could exploit this flaw to complete transactions or access premium features without making a valid payment, leading to direct financial loss for site owners.

Technologies: [Balbooa Gridbox](https://junglewise.ai/threats/technologies/gridbox). Vendors: [Balbooa](https://junglewise.ai/threats/vendors/balbooa).

## Quick answers

**Is CVE-2026-66488 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66488 being exploited in the wild.

**How severe is CVE-2026-66488?** Informational severity, with a CVSS score of 7.5, published 29 July 2026.

**Which products and versions are affected?** Balbooa Gridbox 1.0.0-2.20.1.

**Is there a fix for CVE-2026-66488?** A patch was published on 2026-07-20: Initial partial fixes released in version 2.20.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66488 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66488?** Check whether you run Balbooa Gridbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A payment bypass vulnerability exists in the Balbooa Gridbox extension for Joomla (com_gridbox) in versions prior to 2.20.2. The flaw resides in the handling of payment processing logic, where insufficient validation allows a remote, unauthenticated attacker to bypass the payment step of a transaction. This is part of a larger set of 23 vulnerabilities discovered in the component, which stem from a systemic failure to validate request parameters. An attacker can exploit this to obtain goods or services without authorization. The issue is resolved in version 2.20.2.

## Affected products

- balbooa.com Gridbox extension for Joomla 1.0.0-2.20.1

## Timeline

- 2026-07-20: patched: Initial partial fixes released in version 2.20.1
- 2026-07-29: advisory: Full disclosure of 23 vulnerabilities including payment bypass
- 2026-07-29: patched: Final fix released in version 2.20.2

## References

- [https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/](https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/)
- [https://www.balbooa.com/gridbox](https://www.balbooa.com/gridbox)

## Related threats

- [Balbooa Gridbox stored XSS in reviews](https://junglewise.ai/threats/cve-2026-107903-joomla-extension-balbooa-com-stored-xss-in-reviews-via)
- [balbooa Gridbox unauthenticated arbitrary file deletion via path traversal](https://junglewise.ai/threats/cve-2026-107129-joomla-extension-balbooa-com-unauthenticated-arbitrary-file)
- [Joomla Gridbox extension SQL injection in product sorting](https://junglewise.ai/threats/cve-2026-102788-joomla-extension-balbooa-com-unauthenticated-sql-injection-in)
- [Balbooa Gridbox CSRF in administrative interface](https://junglewise.ai/threats/cve-2026-65947-balbooa-gridbox-csrf-in-administrative-interface)
- [Balbooa Gridbox account takeover via socialLogin method](https://junglewise.ai/threats/cve-2026-65888-balbooa-gridbox-account-takeover-via-sociallogin-method)