Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-78374— Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0

Quick assessment

Affected
joomlart.com T4 Page Builder extension for Joomla
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joomla 扩展 - joomlart.com - T4 Page Builder 扩展版本 < 2.3.0 通过联系表单 AJAX 端点存在开放邮件中继漏洞 - 前端 JSON 编辑器端点暴露了一个名为 contact 的操作，该操作无需身份验证、无 CSRF 令牌、无验证码（在未启用验证码插件时），且没有速率限制。攻击者可以完全控制邮件的收件人、主题和 HTML 正文内容，且邮件将以站点配置的发送者身份（mailfrom/fromname）发出。

CVSS 6.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-78374

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0
Source: CVE Program / CVE List V5
Vulnerability Description
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and the mail is sent from the site's configured sender identity (mailfrom/fromname).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过发送数据的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
joomlart.com T4 Page Builder extension for Joomla 1.0.0-2.2.0 -

II. Public POCs for CVE-2026-78374

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78374

请登录查看更多情报信息。

Vendor Pages for CVE-2026-78374 (1)

IV. Related Vulnerabilities

Same vendor: joomlart.com
Same weakness: CWE-201

V. Comments for CVE-2026-78374

No comments yet

Leave a comment