CVE-2026-75953 Overview
CVE-2026-75953 is an open mail relay vulnerability in the J-BusinessDirectory extension for Joomla, developed by cmsjunkie.com. The flaw affects versions prior to 6.2.3. The extension accepts the recipient address directly from client-supplied request parameters (contact_id_offer and contact_id_event) rather than resolving the recipient from the server-side offer or event record. Attackers can send mail to arbitrary addresses through the affected server. This vulnerability is categorized under [CWE-201]: Insertion of Sensitive Information Into Sent Data.
Critical Impact
Attackers can abuse the vulnerable Joomla site as an open mail relay to deliver arbitrary messages, enabling phishing, spam distribution, and reputational damage to the hosting domain.
Affected Products
- Joomla Extension: J-BusinessDirectory by cmsjunkie.com
- Versions prior to 6.2.3
- Joomla sites deploying the vulnerable offer/event contact functionality
Discovery Timeline
- 2026-08-19 - CVE-2026-75953 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-75953
Vulnerability Analysis
The J-BusinessDirectory extension exposes contact functionality that lets visitors send messages related to business offers and events. The endpoint accepts identifiers named contact_id_offer and contact_id_event from the HTTP request. Instead of using these identifiers to look up the associated recipient email from the server-side database record, the extension treats the parameter value itself as the destination address.
An attacker can substitute any email address into these parameters. The Joomla server then dispatches the composed message to that arbitrary recipient using the site's own mail infrastructure. Because messages originate from a legitimate domain with valid SPF, DKIM, and DMARC records, they bypass many recipient-side filters.
The vulnerability corresponds to [CWE-201], reflecting improper insertion of externally supplied data into outbound communications. EPSS data lists the probability at 0.149% as of 2026-08-20.
Root Cause
The root cause is trusting user-controlled request parameters as authoritative recipient information. The extension should treat contact_id_offer and contact_id_event as opaque database keys, then look up the linked owner email server-side. Skipping this indirection converts a scoped contact form into a general-purpose mail relay.
Attack Vector
Exploitation requires only crafting an HTTP request to the vulnerable contact submission endpoint. The attacker supplies an arbitrary recipient address in place of the expected identifier, along with attacker-controlled subject and body content. The vulnerability does not require authentication when the contact functionality is publicly accessible. See the CMS Junkie Blog for vendor-published information.
Code examples are not available for this advisory. Refer to the vendor advisory for technical details.
Detection Methods for CVE-2026-75953
Indicators of Compromise
- Outbound SMTP traffic from the Joomla host to unusual or high-volume external recipient domains
- Mail server logs showing messages sent via J-BusinessDirectory templates to addresses not present in the site's offer or event records
- Spikes in POST requests to J-BusinessDirectory endpoints containing email-formatted values in contact_id_offer or contact_id_event parameters
Detection Strategies
- Inspect web server access logs for request parameters contact_id_offer and contact_id_event that contain @ characters or full email syntax rather than numeric identifiers
- Correlate contact form submissions with database offer/event IDs to identify mismatches between requested IDs and actual recipients
- Deploy content-based rules on the mail gateway to flag messages generated by the J-BusinessDirectory templating engine that target external domains
Monitoring Recommendations
- Track sending reputation on the domain hosting the Joomla site, including bounce rates and blocklist status
- Rate-limit and log all outbound mail generated by Joomla extensions to establish baseline volumes
- Alert on repeated contact form submissions from the same source IP within short intervals
How to Mitigate CVE-2026-75953
Immediate Actions Required
- Upgrade J-BusinessDirectory to version 6.2.3 or later on all Joomla installations
- Audit outbound mail logs since deployment of vulnerable versions to identify prior abuse
- Rotate any SMTP credentials used by the Joomla mailer if abuse is confirmed
Patch Information
The vendor cmsjunkie.com released a fix in J-BusinessDirectory version 6.2.3. The patched version resolves the recipient address on the server side from the offer or event database record rather than trusting request parameters. Consult the CMS Junkie Blog for release notes and upgrade instructions.
Workarounds
- Disable the J-BusinessDirectory offer and event contact features until the patched version can be deployed
- Restrict the Joomla mail transport to a queue that validates recipients against the site's own offer and event records before delivery
- Apply web application firewall rules that reject requests where contact_id_offer or contact_id_event values contain @ characters or non-numeric syntax
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
