The reported issue is an authentication bypass that allows any user to send email messages using the SP Page Builder’s form feature. A hard‑coded secret key embedded in the plugin is used to validate the "from" address. Because the key is shared across all installations and is not validated against the requesting user, an attacker can submit a form and impersonate any sender. The ability to forge the sender address can be leveraged for phishing campaigns, spam, or other malicious communications, potentially undermining the credibility of the website or facilitating credential‑stealing attacks. The vulnerability directly compromises the integrity of outbound mail, and could indirectly affect confidentiality if sensitive data is transmitted.

The vulnerability resides in the joomshaper.com SP Page Builder extension for the Joomla content management system. All installations of the extension with a version earlier than 6.7.1 are affected. No additional version details are provided.

Based on the description, it is inferred that the attack can originate from any public web interface that allows form submission, because the vulnerability permits unauthenticated use of the form email feature. An attacker can exploit the issue from any location that can submit forms; authentication is not required, so the threat surface is the entire public web interface. The CVSS score of 9.8 identifies the vulnerability as critical, while the EPSS score of <1% suggests a low likelihood of exploitation but does not eliminate risk. The vulnerability is not listed in the CISA KEV catalog. By exploiting the hard‑coded, product‑wide secret, an attacker can forge the email ‘from’ address to send spam, phishing, or other spoofed messages, damaging the site’s reputation and potentially enabling credential‑stealing attacks. The combination of high severity, unauthenticated attack vector, and the possibility of widespread abuse signals a high risk posture.