CVE-2026-78303
MediumCVSS 6.9Summary
The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 relied on client-submitted hidden fields for recipient routing in booking inquiries. This allowed email destination manipulation and form tampering.
Risk Assessment
An attacker may redirect booking messages to an arbitrary email address or modify their content, potentially leading to phishing, spam or data leakage.
Recommendation
Update the SP Property extension to version 4.1.4 or later.
Other vulnerabilities in SP Property
See all- CVE-2026-78085Medium
The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 contains a path traversal vulnerability in the gallery image management controller. The controller tasks lacked directory confinement checks.
- CVE-2026-78302High
Joomla Extension SP Property versions below 4.1.4 contain an unauthenticated stored cross-site scripting (XSS) vulnerability due to unescaped output in views and admin lists. Multiple template files rendered attributes and text values directly into HTML without contextual escaping.
- CVE-2026-78084Medium
The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 contains missing access control in gallery image management. The controller tasks lacked authorization checks and CSRF token validation, allowing users to invoke file removal actions with arbitrary path strings or upload unverified file types.
- CVE-2026-78083High
Joomla Extension SP Property versions below 4.1.4 lack CSRF token verification in the property booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints. These endpoints processed POST requests without verifying Joomla session anti-CSRF tokens.
- CVE-2026-78082Critical
The SP Property extension for Joomla (joomshaper.com) in versions below 4.1.4 contains an unauthenticated SQL Injection vulnerability. The property search and listing query builders (zipcode, sorting, price_range_dropdown, psize_range_dropdown) concatenate raw request parameters directly into SQL strings without quoting or type casting. A remote unauthenticated attacker can perform boolean-based or time-based blind SQL injection to extract sensitive data from the database.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation.