T4 Page Builder (com_t4pagebuilder) below 2.3.0 - Unauthenticated Mail Relay and AcyMailing Table Writes, Missing CSRF Token

JoomlArt released T4 Page Builder 2.3.0 on 28 August 2026, fixing an unauthenticated open mail relay that mySites.guru reported to the vendor and to the Joomla Security Strike Team on 17 August 2026, after finding it in use on a client site. In versions below 2.3.0 the front-end contact action is exempt from the component's ACL checks and accepts a recipient address supplied in the request, so any anonymous visitor can send mail to arbitrary addresses using the site's configured sender identity: the site becomes an open mail relay for spam and phishing sent under its own domain, SPF and DKIM. The same endpoint requires no Joomla form token (CSRF), applies no rate limiting, and relies on whether a captcha plugin is enabled rather than validating a captcha response. The subscribe task on the same endpoint allows unauthenticated writes to connected AcyMailing subscription tables. The component also ships a live Mailchimp API key hardcoded into its source, which should be rotated by its owner. mySites.guru verified the fix by auditing the released 2.3.0 package on 3 September 2026: the contact action now requires a valid form token, rate limits per IP (5 requests per 10 minutes by default), validates captcha explicitly, and delivers only to administrator addresses via getAdminMails() rather than the request-supplied recipient. The hardcoded key is absent from the 2.3.0 package and the Mailchimp credentials are read from component parameters. Update to T4 Page Builder 2.3.0 or later from the JoomlArt member area, clear the Joomla cache, then re-test all contact and subscription forms. Temporary mitigation: unpublish public contact and subscription forms built with T4 Page Builder until the update is applied. CVE-2026-78374 was assigned by the Joomla CNA on 10 September 2026, at the reporter's request rather than the vendor's. The record is reserved and not yet published at MITRE or NVD, and JoomlArt still credits no reporter. The vendor states no affected floor, so every version below 2.3.0 is treated as affected.

How CVE-2026-78374 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

mySites.guru rates this High. Where our assessment and the published record differ, your sites are checked against ours.

Timeline

1. 28 August 2026mySites.guru check added for T4 Page Builder (before 2.3.0)
2. 3 September 2026We published: T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay
3. 10 September 2026CVE-2026-78374 record published by its CNA

Rule details

Our disclosure post

T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay

JoomlArt's T4 Page Builder 2.3.0 closes an unauthenticated open mail relay we reported in August. A week on, five in six installs we see are still older.

3 Sept 2026

Other vulnerabilities in T4 Page Builder

Updating for CVE-2026-78374 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

References

• CVE-2026-78374 on cve.org (the official CVE record)
• CVE-2026-78374 in the NIST National Vulnerability Database
• T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay
• joomlart.com/blog/news-updates/t4-page-builder-2-3-0-released-security