Affected: tassos.gr Novarain/Tassos Framework (plg_system_nrframework), tassos.gr Convert Forms, tassos.gr EngageBox, tassos.gr Google Structured Data, tassos.gr Advanced Custom Fields, tassos.gr Smile Pack

The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.