Skip to main content
mySites.guru
Free Audit
CriticalA PHP security release fixes two CVSS 9.2 flaws, and PHP 8.1 and older get no patchWhat it means for your site
CVE-2026-78082CriticalCVSS 9.3CVE published 10 September 2026Added to mySites.guru 10 September 2026

SP Property Finder (com_spproperty) below 4.1.4 - Unauthenticated SQL Injection (full database read) and Mail Relay

SP Property Finder below 4.1.4 contains an unauthenticated blind SQL injection in the public property search and map views, found by mySites.guru and reported privately to JoomShaper on 10 August 2026. Several search filters (the postcode, the sort control, and the price and size range dropdowns) are placed straight into the database query with no quoting, so an anonymous visitor with no login and no token can read any table in the Joomla database, password hashes and the site secret included. The injection is read-only, but reading the session table lets an attacker steal a logged-in administrator's session and take over the site from there, so treat it as serious. A second, lower-severity issue let the property contact and enquiry forms send email to any recipient with a spoofed sender (an unauthenticated mail relay). JoomShaper fixed both in SP Property Finder 4.1.4, released on 10 September 2026, which quotes and casts every filter value, validates the sort control against an allow-list, and derives the mail recipient from a database lookup instead of the request. mySites.guru verified the fix against the build JoomShaper shipped as 4.1.4. The same release also fixed further issues that mySites.guru did not report, tracked as CVE-2026-78084, CVE-2026-78302 and CVE-2026-78303. The reporter's two findings are CVE-2026-78082 (the SQL injection, published by the Joomla CNA at 9.3 Critical and credited to Phil Taylor of mySites.guru) and CVE-2026-78303 (the mail relay). The release also fixed CVE-2026-78083, CVE-2026-78084 and CVE-2026-78302, which mySites.guru did not report. All five CVE records were published at MITRE on 10 September 2026. Update to SP Property Finder 4.1.4 or later from JoomShaper. Updating closes the flaw but does not undo any database read that already happened: if a vulnerable version was public for a while, treat the password hashes and the site secret as potentially known.

Is my site affected?

Affected
SP Property Finder before 4.1.4
Fixed in
4.1.4
What to do
Update SP Property Finder to 4.1.4 or later.
Check whether your sites are affected

How CVE-2026-78082 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

9.3 Critical

CVSS 4.0, scored by Joomla CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

How it is reached

AV:N Attack vector
Network. Reachable across the internet
AC:L Attack complexity
Low. Nothing to work around, it just works
AT:N Attack requirements
None. Works against any affected install
PR:N Privileges required
None. No account needed
UI:N User interaction
None. Nobody has to be tricked into anything

What it does to the site

VC:H Confidentiality
High. Everything the site holds can be read
VI:H Integrity
High. Data and files can be altered at will
VA:H Availability
High. The site can be taken down

What it does beyond the site

SC:N Confidentiality
None. Other systems keep their data
SI:N Integrity
None. Other systems keep their integrity
SA:N Availability
None. Other systems stay up

Timeline

  1. 10 September 2026CVE-2026-78082 record published by its CNA
  2. 10 September 2026mySites.guru check added for SP Property Finder (before 4.1.4)
  3. 10 September 2026We published: Unauthenticated SQL Injection in SP Property Finder found by mySites.guru

Rule details

Our disclosure post

Unauthenticated SQL Injection in SP Property Finder found by mySites.guru

Unauthenticated SQL Injection in SP Property Finder found by mySites.guru

mySites.guru found an unauthenticated blind SQL injection in JoomShaper's SP Property Finder. Any visitor could read the database. Fixed in 4.1.4.

Other vulnerabilities in SP Property Finder

Updating for CVE-2026-78082 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

SP Property Finder

Latest safe version: 4.1.4

References

CVE-2026-78082 questions

Which versions are affected by CVE-2026-78082?
CVE-2026-78082 affects SP Property Finder before 4.1.4. The fix is in 4.1.4.
How do I fix CVE-2026-78082?
Update SP Property Finder to 4.1.4 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2026-78082?
Joomla CNA scores it 9.3 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 22 October 2026.