CVE-2026-75952
MediumCVSS 4.6Summary
Joomla extension J-BusinessDirectory before version 6.2.3 contains a Cross-site request forgery (CSRF) vulnerability. Tokens are missing on many AJAX/state-changing tasks such as contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions. Frontend CSRF requires a registered/listing-owner session, while admin CSRF requires a backend admin session.
Risk Assessment
An attacker can exploit CSRF to perform unauthorized actions on behalf of a logged-in user or administrator, potentially leading to unauthorized changes, app installation, data deletion, or payment notification sending.
Recommendation
Update J-BusinessDirectory to version 6.2.3 or later, which includes fixes for missing CSRF tokens. Additionally, consider implementing additional CSRF protections such as custom headers.
Original NVD description (English source)
Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions (app install, demo-data wipe, cache/statistics archive, payment notification send, mobile push). Frontend CSRF needs a registered/listing-owner session; admin CSRF needs a backend admin session.