CVE-2026-78374: CWE-201: Insertion of Sensitive Information Into Sent Data in joomlart.com T4 Page Builder extension for Joomla

The T4 Page Builder extension for Joomla versions 1.0.0 to 2.2.0 contains an open mail relay vulnerability via its front-end JSON editor contact AJAX endpoint. This endpoint does not require authentication, CSRF tokens, or captcha protection when no captcha plugin is enabled, and it has no rate limiting. An attacker can exploit this to send arbitrary emails with controlled recipient, subject, and HTML body, using the site's configured sender identity. This is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data).

An attacker can abuse the contact AJAX endpoint to send arbitrary emails from the vulnerable Joomla site without authentication or rate limiting. This can lead to spam or phishing emails appearing to originate from the legitimate site, potentially damaging reputation and trust. The vulnerability does not require user interaction or privileges, increasing its risk. However, no known exploits are reported in the wild at this time.

No official patch or fix is currently provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider enabling captcha plugins to mitigate automated abuse and restrict access to the contact endpoint if possible.