CVE-2026-78374: Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and the mail is sent from the site's configured sender identity (mailfrom/fromname).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to abuse through this endpoint?
Sites running T4 Page Builder versions earlier than 2.3.0 are exposed if the front-end JSON editor contact action is reachable. The endpoint does not require authentication or a CSRF token.
What does an attacker need to send mail through the site?
An attacker only needs to submit requests to the exposed contact action. They can choose the recipient, subject, and HTML body, and messages are sent using the site's configured sender address and name.
Does CAPTCHA prevent exploitation?
No CAPTCHA is required when no CAPTCHA plugin is enabled. The available information does not establish whether an enabled CAPTCHA plugin protects this endpoint.
What makes large-scale abuse likely?
The endpoint has no rate limiting, allowing repeated unauthenticated requests. This can enable bulk spam or phishing messages that appear to originate from the site's configured sender identity.