Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-78374

T4 Page Builder extension for Joomla · Vulnerability

CVSS 4.0 6.9 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-78374

Published

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and the mail is sent from the site's configured sender identity (mailfrom/fromname).

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-78374

Published

T4 Page Builder extension for Joomla

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "T4 Page Builder extension for Joomla",
                    "vendor": "joomlart.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-2.2.0"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON