{"id":"CVE-2026-78303","title":"Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing pote…","summary":"Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing pote…","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-201"],"vendor":"joomshaper.com","product":"SP Property extension for Joomla","affected":["sp_property_extension_for_joomla 1.0.0-4.1.3"],"published":"2026-09-10","updated":"2026-09-10","sourceUpdated":"2026-09-10T15:13:07.090","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78303","references":[{"url":"https://www.joomshaper.com/joomla-extensions/sp-property","label":"security@joomla.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-10T12:21:34.526999Z"},"cvssSource":"cna","ingestedAt":"2026-09-14T13:53:10.665Z","epss":0.00428,"epssPercentile":0.34318,"slug":"CVE-2026-78303","body":"## Overview\n\nJoomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}