SP Property CVE-2026-78303

No special conditions are required beyond the availability of a publicly accessible SP Property booking inquiry form on an unpatched Joomla installation running versions 1.0.0 through 4.1.3. The attacker requires only the ability to load and submit the form - no account, no authentication, and no privileged network position. Exploitation is limited to sites with SP Property installed and at least one active property listing that exposes a booking form. The attack does not achieve server-side code execution, database access, or persistent modification of the application; impact is strictly confined to email misdirection and passive collection of contact data submitted by third-party visitors through the manipulated form.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote exploitability with no authentication, no special attack conditions, and no required user interaction, which maximizes attacker reach across all exposed booking forms. The score of 6.9 reflects moderate-to-low impact: VC:L (booking inquiry data disclosed to attacker) and VA:L (legitimate recipients silently miss inquiries, disrupting the business booking workflow). Notably, VI:N in the provided vector appears inconsistent with email redirection being fundamentally an integrity concern - the correct destination of a message is an integrity property. This metric is flagged as an anomaly worth verifying with the vendor. No EPSS score is present in the available intelligence, and there is no KEV listing or public exploit code. Real-world risk is moderate in operational terms: the attack is trivially simple (hidden field tampering via browser developer tools), entirely scriptable, and undetectable by the victim property owner. However, impact is bounded to lead hijacking and contact-data harvesting rather than server-side code execution or database compromise.

An attacker identifies a Joomla site running an unpatched SP Property installation, navigates to a public property listing with a booking inquiry form, and uses browser developer tools to replace the hidden recipient email field value with their own address before submitting a plausible inquiry. The extension routes the form submission to the attacker-controlled address, delivering the prospective buyer's name, phone number, and message, while the legitimate agent receives no notification - enabling silent, ongoing lead harvesting at scale across any number of property listings.