Threat database

CVE-2026-78374 is a medium severity vulnerability in the T4 Page Builder extension for Joomla by joomlart.com. Versions 1.0.0 through 2.2.0 are affected. The vulnerability allows unauthenticated attackers to send emails via an open mail relay through the front-end JSON editor's contact AJAX endpoint. This endpoint lacks authentication, CSRF protection, captcha enforcement (if no captcha plugin is enabled), and rate limiting. Attackers can fully control the recipient, subject, and HTML body of the email, which is sent from the site's configured sender identity.