The extension’s booking (properties.booking) and agent contact (agents.sendmail) endpoints accept POST data without checking Joomla’s CSRF token. An attacker can construct a request that a victim’s browser will automatically submit, causing unintended actions such as fake bookings or spam communications. The flaw is a typical cross‑site request forgery weakness, exposing the system to data tampering, denial of service by flooding bookings, or privacy breaches through unsolicited agent messages.

The vulnerability affects the joomshaper.com SP Property extension for Joomla when the installed version is older than 4.1.4. Only these older releases process the vulnerable endpoints without CSRF validation. Users running 4.1.4 or newer are not impacted.

The CVSS score of 7.1 indicates a high impact level. The EPSS score is not available, but CSRF attacks are common and easy to automate without special credentials, suggesting realistic risk. The vulnerability is not listed in the CISA KEV catalog, so it is not known to be actively exploited in the wild at this time. An attacker can target a site by hosting a malicious page that submits a form to either endpoint; no elevated privileges or complex configuration are required beyond user interaction.