Executive brief
JoomShaper SP Page Builder, a popular drag-and-drop design tool for Joomla websites, contained a security flaw in its contact form components. Because the software used a single secret password shared across every installation worldwide, attackers could bypass security checks to send unauthorized emails. This effectively turns a legitimate website into an open relay for spam and phishing campaigns, which can severely damage the site owner's domain reputation and lead to email blacklisting.
Technical details
The vulnerability exists in the contact-form addons (ajax_contact and form_builder) of SP Page Builder. The extension attempts to prevent tampering with form recipients by signing the recipient address with a secret; however, this secret was hardcoded into the source code (site.php) and was identical across all installations. An unauthenticated attacker can use this known secret to forge valid signatures offline, allowing them to specify arbitrary recipients and spoofed sender addresses. When combined with weaknesses in the built-in captcha and CSRF protections, this allows the component to be used as an open mail relay. The issue is resolved in version 6.7.1 by switching to the unique Joomla site secret for cryptographic signing.
Affected products
- JoomShaper SP Page Builder extension for Joomla 1.0.0-6.7.0
Timeline
- 2026-07-27: patched: Fixed in SP Page Builder 6.7.1
- 2026-07-27: disclosed: Vulnerability disclosed by mySites.guru
- 2026-07-27: advisory