# T4 Page Builder security vulnerabilities [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/T4 Page Builder # T4 Page Builder security vulnerabilities mySites.guru tracks 1 vulnerability in T4 Page Builder (com\_t4pagebuilder), covering 1 CVE. Every connected Joomla site is checked against it on each audit. ## Is my site affected? Your site is affected if it runs T4 Page Builder in this range: - before 2.3.0 - **Latest safe version** - 2.3.0 or later. No rule we check matches that release or any newer one. - **What to do** - Update T4 Page Builder to 2.3.0 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## Every T4 Page Builder vulnerability we track Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses. CVE Affected versions Fixed in Severity Added [CVE-2026-78374](https://mysites.guru/vulnerabilities/CVE-2026-78374/)CVSS 6.9 before 2.3.0 2.3.0 High 2026-08-28 ## What we check for High[CVE-2026-78374](https://mysites.guru/vulnerabilities/CVE-2026-78374/)2026-08-28 ### T4 Page Builder (com\_t4pagebuilder) below 2.3.0 - Unauthenticated Mail Relay and AcyMailing Table Writes, Missing CSRF Token JoomlArt released T4 Page Builder 2.3.0 on 28 August 2026, fixing an unauthenticated open mail relay that mySites.guru reported to the vendor and to the Joomla Security Strike Team on 17 August 2026, after finding it in use on a client site. In versions below 2.3.0 the front-end contact action is exempt from the component's ACL checks and accepts a recipient address supplied in the request, so any anonymous visitor can send mail to arbitrary addresses using the site's configured sender identity: the site becomes an open mail relay for spam and phishing sent under its own domain, SPF and DKIM. The same endpoint requires no Joomla form token (CSRF), applies no rate limiting, and relies on whether a captcha plugin is enabled rather than validating a captcha response. The subscribe task on the same endpoint allows unauthenticated writes to connected AcyMailing subscription tables. The component also ships a live Mailchimp API key hardcoded into its source, which should be rotated by its owner. mySites.guru verified the fix by auditing the released 2.3.0 package on 3 September 2026: the contact action now requires a valid form token, rate limits per IP (5 requests per 10 minutes by default), validates captcha explicitly, and delivers only to administrator addresses via getAdminMails() rather than the request-supplied recipient. The hardcoded key is absent from the 2.3.0 package and the Mailchimp credentials are read from component parameters. Update to T4 Page Builder 2.3.0 or later from the JoomlArt member area, clear the Joomla cache, then re-test all contact and subscription forms. Temporary mitigation: unpublish public contact and subscription forms built with T4 Page Builder until the update is applied. CVE-2026-78374 was assigned by the Joomla CNA on 10 September 2026, at the reporter's request rather than the vendor's. The record is reserved and not yet published at MITRE or NVD, and JoomlArt still credits no reporter. The vendor states no affected floor, so every version below 2.3.0 is treated as affected. Affected versions: < 2.3.0 Full advisory: [our disclosure post](https://mysites.guru/blog/t4-page-builder-2-3-0-mail-relay-fix/) ยท [www.joomlart.com](https://www.joomlart.com/blog/news-updates/t4-page-builder-2-3-0-released-security-hardening-and-admin-improvements) ## Timeline 1. 28 August 2026Check added for CVE-2026-78374 (before 2.3.0) 2. 3 September 2026[We published: T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay](https://mysites.guru/blog/t4-page-builder-2-3-0-mail-relay-fix/) 3. 10 September 2026[CVE-2026-78374 record published](https://mysites.guru/vulnerabilities/CVE-2026-78374/) ## What we have written about T4 Page Builder [![T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay](https://mysites.guru/_astro/t4-page-builder-2-3-0-mail-relay-fix.DZmQUuGB_Z1Xdu3S.webp) ### T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay JoomlArt's T4 Page Builder 2.3.0 closes an unauthenticated open mail relay we reported in August. A week on, five in six installs we see are still older. 3 Sept 2026 ](https://mysites.guru/blog/t4-page-builder-2-3-0-mail-relay-fix/) ## References - [T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay](https://mysites.guru/blog/t4-page-builder-2-3-0-mail-relay-fix/) - [joomlart.com/blog/news-updates/t4-page-builder-2-3-0-released-security](https://www.joomlart.com/blog/news-updates/t4-page-builder-2-3-0-released-security-hardening-and-admin-improvements) Each CVE page above links its official cve.org record and its NVD entry. ## T4 Page Builder vulnerability questions Show all Which versions of T4 Page Builder are vulnerable? mySites.guru tracks one vulnerability in T4 Page Builder (com\_t4pagebuilder). A site is affected if its installed version is in this range: before 2.3.0. What is the latest safe version of T4 Page Builder? 2.3.0. Every vulnerability tracked here is fixed by 2.3.0, and no rule we check matches that release or any later one. How do I check which version of T4 Page Builder my Joomla site runs? The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com\_t4pagebuilder. mySites.guru reads the installed version on every audit of a connected site and checks it against this rule. ## Running T4 Page Builder on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). CVE identifiers: [CVE-2026-78374](https://mysites.guru/vulnerabilities/CVE-2026-78374/). Rules current as of 14 October 2026.