T4 Page Builder (com_t4pagebuilder) below 2.3.0 - Unauthenticated Mail Relay and AcyMailing Table Writes, Missing CSRF Token
JoomlArt released T4 Page Builder 2.3.0 on 28 August 2026, fixing an unauthenticated open mail relay that mySites.guru reported to the vendor and to the Joomla Security Strike Team on 17 August 2026, after finding it in use on a client site. In versions below 2.3.0 the front-end contact action is exempt from the component's ACL checks and accepts a recipient address supplied in the request, so any anonymous visitor can send mail to arbitrary addresses using the site's configured sender identity: the site becomes an open mail relay for spam and phishing sent under its own domain, SPF and DKIM. The same endpoint requires no Joomla form token (CSRF), applies no rate limiting, and relies on whether a captcha plugin is enabled rather than validating a captcha response. The subscribe task on the same endpoint allows unauthenticated writes to connected AcyMailing subscription tables. The component also ships a live Mailchimp API key hardcoded into its source, which should be rotated by its owner. mySites.guru verified the fix by auditing the released 2.3.0 package on 3 September 2026: the contact action now requires a valid form token, rate limits per IP (5 requests per 10 minutes by default), validates captcha explicitly, and delivers only to administrator addresses via getAdminMails() rather than the request-supplied recipient. The hardcoded key is absent from the 2.3.0 package and the Mailchimp credentials are read from component parameters. Update to T4 Page Builder 2.3.0 or later from the JoomlArt member area, clear the Joomla cache, then re-test all contact and subscription forms. Temporary mitigation: unpublish public contact and subscription forms built with T4 Page Builder until the update is applied. CVE-2026-78374 was assigned by the Joomla CNA on 10 September 2026, at the reporter's request rather than the vendor's. The record is reserved and not yet published at MITRE or NVD, and JoomlArt still credits no reporter. The vendor states no affected floor, so every version below 2.3.0 is treated as affected.
Affected versions: < 2.3.0
Full advisory: our disclosure post · www.joomlart.com
