Executive brief
T4 Page Builder is a popular Joomla page builder extension used by over 300,000 websites to create content visually. The contact form functionality in the JSON editor endpoint lacks authentication and rate limiting, allowing attackers to send unlimited emails from the website's own mail account to arbitrary recipients with arbitrary content. This can be exploited for spam campaigns, phishing attacks, and reputation damage.
Technical details
The vulnerability is an unauthenticated open mail relay in the T4 Page Builder's front-end JSON editor AJAX endpoint. The contact action requires no authentication, CSRF token, or captcha validation (when no captcha plugin is active), and has no rate limiting. An attacker can craft requests to send emails with full control over the recipient address, subject line, and HTML body, with emails appearing to originate from the site's configured mail sender identity (mailfrom/fromname). This allows arbitrary abuse of the affected website's mail infrastructure to send phishing emails, spam, or malware distribution campaigns. The vulnerability affects versions prior to 2.3.0.
Affected products
- JoomlArt T4 Page Builder < 2.3.0
Timeline
- 2026-09-10: disclosed