CVE-2026-78303: Joomla SP Property Email Manipulation Flaw

CVE-2026-78303 is an information disclosure vulnerability in Joomla SP Property extension affecting versions below 4.1.4. Attackers can manipulate booking inquiry emails through unvalidated form fields. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-78303 Overview

CVE-2026-78303 affects the JoomShaper SP Property extension for Joomla in versions prior to 4.1.4. The booking inquiry feature relied on client-submitted hidden form fields to determine the recipient email address. An attacker can manipulate these fields to redirect booking inquiries to arbitrary destinations or alter form content. The issue is classified under [CWE-201] Insertion of Sensitive Information Into Sent Data, because inquiry data can be routed to unintended recipients.

Critical Impact
Unvalidated recipient routing allows attackers to redirect booking inquiries and expose submitted personal data to arbitrary email destinations.

Affected Products

JoomShaper SP Property extension for Joomla
SP Property versions prior to 4.1.4
Joomla sites using SP Property booking inquiry forms

Discovery Timeline

2026-09-10 - CVE-2026-78303 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78303

Vulnerability Analysis

The SP Property extension processes booking inquiries submitted through a public web form. The server-side handler trusts hidden form fields to determine the destination email address for the inquiry. Because the form is rendered client-side, an attacker can modify these hidden fields before submission. The mailer then sends the booking data to any address the attacker chooses.

This behavior enables two abuse scenarios. First, attackers can exfiltrate inquiry contents, including names, contact details, and property interest, to attacker-controlled inboxes. Second, attackers can leverage the trusted sending domain to relay manipulated inquiry content to third parties, aiding phishing and impersonation campaigns targeting property listings.

Root Cause

The root cause is reliance on client-controlled input for a security-sensitive routing decision. Recipient addresses and related routing metadata should be resolved server-side from trusted configuration or database records tied to the listing identifier. Storing them in hidden form fields treats the browser as a trusted component, which it is not.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction beyond submitting a modified form. An attacker intercepts or reconstructs the booking form, edits hidden fields such as recipient email or listing metadata, and submits the request. See the JoomShaper SP Property Extension product page for feature context. No verified exploit code is publicly available.

Detection Methods for CVE-2026-78303

Indicators of Compromise

Outbound SMTP messages from the Joomla host addressed to recipients that do not match any configured listing owner.
Web server access logs showing repeated POST requests to the SP Property booking endpoint with varying hidden field values.
Booking inquiry emails delivered with tampered subject lines, body content, or reply-to addresses inconsistent with the listing.

Detection Strategies

Compare recipient addresses in outbound inquiry emails against the authoritative list of listing owners stored in the Joomla database.
Inspect HTTP request bodies to the booking submission endpoint for unexpected fields or values in recipient-related parameters.
Alert on booking submissions where the referring page, user agent, or submission cadence deviates from normal user behavior.

Monitoring Recommendations

Enable verbose mail transport logging on the Joomla host and forward events to a centralized log platform.
Monitor the SP Property component version across sites and flag any instance running a release earlier than 4.1.4.
Track sender reputation for the domain used by the Joomla mailer to detect abuse-driven blacklisting.

How to Mitigate CVE-2026-78303

Immediate Actions Required

Upgrade the SP Property extension to version 4.1.4 or later on all Joomla installations.
Audit recent booking inquiry emails for unexpected recipients and notify affected listing owners of potential data exposure.
Rotate any credentials or API keys that may have been included in submitted inquiries routed to unintended destinations.

Patch Information

JoomShaper addresses the issue in SP Property 4.1.4 by resolving the recipient address server-side rather than trusting hidden form fields. Administrators should obtain the fixed release from the JoomShaper SP Property Extension page and apply it through the Joomla Extensions Manager.

Workarounds

Temporarily disable the SP Property booking inquiry form until the patched version is installed.
Restrict outbound SMTP on the Joomla host to a smart relay that enforces an allow list of legitimate inquiry recipients.
Deploy a web application firewall rule that rejects booking form submissions containing email addresses in hidden fields.

bash

# Example WAF rule concept for ModSecurity to block hidden email fields
SecRule REQUEST_URI "@contains /index.php?option=com_spproperty" \
  "chain,phase:2,deny,status:403,id:1026078303,msg:'SP Property hidden email field detected'"
  SecRule ARGS_NAMES "@rx (?i)(recipient|to|mailto|owner_email)" "t:none"