EUVD-2026-75386
GHSA-3ghv-6pr7-rjxg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fully unauthenticated network endpoint; limited confidentiality (email delivery signals) and availability (mail server abuse/blocklisting) impact; no integrity breach on the vulnerable system itself.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and the mail is sent from the site's configured sender identity (mailfrom/fromname).
AnalysisAI
T4 Page Builder by JoomlArt (versions below 2.3.0) exposes an unauthenticated front-end AJAX contact endpoint that functions as a fully open mail relay, allowing any remote actor to send arbitrary email as the victim Joomla site's configured sender identity. The endpoint accepts attacker-controlled recipient address, subject line, and full HTML message body with no authentication, no CSRF token, no captcha when no captcha plugin is active, and no rate limiting. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | T4 Page Builder extension version below 2.3.0 must be installed and enabled on the Joomla site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated network exploitation with no complexity or prerequisites, consistent with the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update T4 Page Builder to version 2.3.0 or later, which is the vendor-confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today