J-BusinessDirectory EUVD-2026-62498

Exploitation requires that the target site has J-BusinessDirectory version 6.2.2 or earlier installed and active on a Joomla CMS instance, with at least one published offer or event listing whose contact form is publicly accessible. No authentication, session token, or special network position is required - any unauthenticated HTTP client that can reach the contact form endpoint is a viable attacker. The limiting factors are: (1) the vulnerability is extension-specific and does not affect Joomla core or sites without this extension; (2) exploitation yields email interception or relay abuse rather than code execution or server compromise; (3) relay abuse impact depends on the site's mail infrastructure configuration. No user interaction by the victim is required to trigger email dispatch.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly reflects unauthenticated network exploitation with no complexity barrier, and the C:H rating is defensible given that intercepted contact emails may carry PII and sensitive business inquiry data that is fully disclosed to the attacker. However, real-world priority should be calibrated against the low EPSS score of 0.15% at the 5th percentile and the absence from CISA KEV, both of which indicate no observed widespread or targeted exploitation at time of analysis. The vulnerability is constrained to sites running this specific niche Joomla extension; it does not affect Joomla core. The primary risks are twofold: (1) email interception - attackers receive business inquiries intended for directory listing owners, exposing submitter PII - and (2) mail relay abuse for spam or phishing campaigns, which can damage the site's email sender reputation. No conflicting signals exist across data sources, though the C:H designation may overstate impact in deployments where contact form content is low-sensitivity.

An unauthenticated attacker identifies a Joomla site running J-BusinessDirectory with a published offer or event listing, then submits a contact form POST request with the contact_id_offer or contact_id_event parameter set to an attacker-controlled email address. The site's mail server dispatches the inquiry - including the submitter's name, email, and message - to the attacker's inbox instead of the intended business owner, fully disclosing the contact data. The same technique can be scripted to bulk-relay phishing messages through the site's SMTP infrastructure, leveraging the site's sender reputation.