Vulnerability · Published Sep 10, 2026 · Assigned by Joomla

CVE-2026-78374Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0

Medium 6.9

In plain English

A medium-severity security flaw in T4 Page Builder extension for Joomla from joomlart.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 54.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and the mail is sent from the site's configured sender identity (mailfrom/fromname).

Affected products (as reported)

Vendor	Product	Versions
joomlart.com	T4 Page Builder extension for Joomla	1.0.0-2.2.0

Weakness: CWE-201 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://www.joomlart.com/t4-builder/t4-joomla-page-builder product