Two unauthenticated vulnerabilities in SP Property Finder affect versions 1.0.0 through 4.1.3: a Critical SQL injection issue and a mail relay–style form abuse issue. Joomla administrators should update to version 4.1.4 or later, then review database, administrator, and mail activity for signs of prior misuse.
Joomla sites using SP Property Finder should treat this as a prompt patching and review task. The verified issues are remotely reachable without authentication, affect a long range of releases, and could expose database information or permit misuse of a site’s outbound mail capability.
What Joomla administrators need to know
The SP Property extension for Joomla, commonly known as SP Property Finder, is affected by two separately tracked vulnerabilities in versions 1.0.0 through 4.1.3. The required remediation for both is to update to SP Property Finder 4.1.4 or later.
The first issue, CVE-2026-78082, is an unauthenticated SQL injection vulnerability in public property search and map-filtering functions. The second, CVE-2026-78303, concerns unvalidated email destinations and form manipulation in booking or contact requests. That second condition may allow a vulnerable site’s mail system to be abused to send messages to arbitrary recipients.
Neither issue requires a Joomla account according to the assigned CVE information. That makes accurate asset identification especially important for agencies and administrators who manage multiple Joomla installations, including older property-listing sites that may not receive frequent editorial updates.
Updating removes the known vulnerable conditions; it does not establish whether a particular site was accessed or abused before it was patched. Sites running an affected release should therefore pair the update with proportionate post-patch checks.
Verified SP Property Finder vulnerability summary
The following table reflects the verified information available for the two CVEs. CVSS is a severity measurement, not evidence that exploitation has happened on a specific site.
| Extension | CVE | Authentication | Affected versions | Recommended version | CVSS 4.0 | CISA KEV status |
|---|---|---|---|---|---|---|
| SP Property Finder | CVE-2026-78082 | None | 1.0.0 through 4.1.3 | 4.1.4 or later | 9.3 Critical | Not listed |
| SP Property Finder | CVE-2026-78303 | None | 1.0.0 through 4.1.3 | 4.1.4 or later | 6.9 Medium | Not listed |
The Joomla CNA assigned the official CVSS 4.0 ratings: 9.3 Critical for CVE-2026-78082 and 6.9 Medium for CVE-2026-78303. An alternative 8.7 High assessment has appeared in third-party reporting for the SQL injection issue, but that is not the official CNA score and should not be substituted for it.
CVE-2026-78082: unauthenticated SQL injection
CVE-2026-78082 is classified as an unauthenticated SQL injection vulnerability, CWE-89, affecting SP Property Finder’s property search, listing, and map-filtering functionality. The issue involves request parameters that are not adequately validated before queries are handled.
In practical terms, a SQL injection weakness can allow an external party to manipulate database queries. The CVE information indicates that this issue could enable blind SQL injection and potentially expose sensitive information held in the site database. The exact impact on an individual site depends on its data, database permissions, logging, hosting configuration, and whether any suspicious requests were made while the vulnerable version was available.
For Joomla operators, the risk is not limited to public property listings. A site database can contain user-account records, configuration-related information, extension data, enquiry details, and other business information. This does not mean those data were accessed on every affected installation; it explains why the official 9.3 Critical severity warrants immediate attention.
After applying the update, review web-server access logs and any available database or application logs for anomalous activity around property search and map views. Look for unexpected request patterns, repeated failed requests, unusual error volumes, or activity from sources that do not fit the site’s normal traffic. Preserve relevant logs before rotation if a review identifies concerns, and involve the hosting provider or a qualified incident-response resource when evidence suggests a possible compromise.
CVE-2026-78303: email destination manipulation and relay abuse
CVE-2026-78303 affects booking and contact requests in SP Property Finder. The verified description identifies unvalidated email-destination and form-manipulation behaviour in which recipient routing can rely on client-supplied hidden fields. An unauthenticated party may therefore be able to cause the site to send messages to arbitrary recipients through its configured mail system.
This is best understood as mail relay–style abuse. It does not mean that every affected Joomla site became a conventional unrestricted SMTP relay. However, abuse of a web application’s contact or enquiry workflow can still have meaningful operational consequences: increased outbound mail volume, bounce messages, complaints, mail-provider restrictions, and damage to the sending domain’s reputation.
Because the weakness affects public-facing forms, administrators should inspect mail activity as well as Joomla itself. Check the mail provider’s dashboard or logs, SMTP or hosting logs where available, bounce notifications, spam or abuse complaints, and any sudden changes in sending limits or delivery performance. Where suspicious outbound messages are found, ask the hosting or mail provider to help determine the sending period, recipient patterns, and whether account or service restrictions are required.
After patching, retain sensible controls around all public forms. Rate limiting and monitoring for unusual email volume can reduce the impact of future abuse. Domain-level controls such as SPF, DKIM, and DMARC should also be correctly configured. These controls do not replace patching the extension, but they can improve mail authentication and reduce the wider consequences of unauthorised mail sent in a domain’s name.
Patch first, then perform a focused review
For an affected SP Property Finder installation, the first priority is eliminating the vulnerable version. Take a current backup consistent with the site’s change-control process, obtain the update from the SP Property extension source, and confirm after deployment that the installed extension version is 4.1.4 or later. Test essential property-search, map, booking, and contact workflows after updating so that the security change does not leave customer-facing functions unintentionally unavailable.
A practical response checklist, in priority order, is:
- Find every installation. Inventory Joomla sites that use SP Property Finder, including staging, legacy, and low-traffic sites. Establish the installed version for each one.
- Patch affected releases promptly. Update every installation running versions 1.0.0 through 4.1.3 to SP Property Finder 4.1.4 or later.
- Validate the deployment. Confirm the extension version after the update and test legitimate listing searches, map filters, booking requests, and contact forms.
- Review access and database-related evidence. Examine web-server and database logs where available for suspicious patterns. Review Joomla administrator accounts, especially recently created accounts or unexpected privilege changes.
- Review outbound email evidence. Check mail logs, bounce reports, provider alerts, and abuse complaints for unexplained volume or delivery activity. Escalate suspected abuse to the hosting or mail provider.
- Improve baseline controls. Use least-privilege database credentials where practical, keep Joomla and extensions current, enable alerting for unusual administrator logins or outbound mail activity, and verify SPF, DKIM, and DMARC settings.
If evidence suggests a possible incident, avoid treating the update as the end of the response. Preserve relevant logs, document the affected period, review credentials and privileged accounts, and assess whether data exposure or mail abuse needs further investigation. The available evidence does not support a guarantee that no data was accessed before patching.
Severity, exploitation status, and deferred NVD analysis
It is useful to separate vulnerability severity from observed exploitation. CVSS estimates the technical severity of a vulnerability under a defined scoring model. It does not prove that attackers have used the vulnerability against a particular Joomla site.
For these two issues, the official Joomla CNA CVSS 4.0 scores are 9.3 Critical for CVE-2026-78082 and 6.9 Medium for CVE-2026-78303. Those scores justify a prompt remediation decision, particularly because both issues are unauthenticated and affect public-facing functionality.
At the time of the verified review, neither CVE is listed in CISA’s Known Exploited Vulnerabilities catalog. There is also no authoritative confirmation of active exploitation in the wild and no authoritative evidence that ransomware groups are using either vulnerability. The absence of those confirmations should not be mistaken for a reason to delay patching; it simply means administrators should communicate risk accurately rather than claim incidents that the evidence does not establish.
The NVD entry for CVE-2026-78082 and the NVD entry for CVE-2026-78303 both have a status of Deferred. NVD has therefore not completed its own analysis for these records. Future NVD updates may add or refine information, but the existing Joomla CNA-assigned CVE data is sufficient to identify the affected range and take the required defensive action.
Add comment