Hardcoded Secret Enables Unauthenticated Mail Relay Attacks

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.

Casky was already ahead

This CVE exploits attack patterns that Casky's 233matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SP Page Builder, a widely-used Joomla extension from JoomShaper, contained a critical vulnerability in versions prior to 6.7.1 that exposed a hardcoded secret credential embedded across all installations. This flaw allowed unauthenticated attackers to forge the "from" address on form submissions, enabling mail relay attacks that could be weaponized for phishing, spam distribution, and social engineering campaigns. With a CVSS score of 9.8, this vulnerability affected any organization running vulnerable versions of the extension—particularly impacting educational institutions, small businesses, and enterprises relying on Joomla-based websites for customer communications and lead generation.

Casky's 233 matched security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with CWE-798 (hardcoded credentials) and MITRE ATT&CK technique TA0006 (credential access). Practitioners using Casky would identify suspicious indicators including: unauthorized form submission requests with forged sender addresses, anomalous mail relay traffic originating from web application servers, and API calls attempting to leverage known hardcoded secrets in SP Page Builder configurations. The platform's skill mapping would surface detection opportunities at multiple stages—from identifying hardcoded secrets in extension code repositories, to monitoring for credential reuse patterns, to detecting lateral movement attempts following successful credential compromise. This multi-layered approach enables practitioners to move beyond simple vulnerability scanning and understand the actual attack chain an adversary might execute against their Joomla infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

233 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-65879.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2026-65879

Casky has 233 skills that investigate the attack patterns behind CVE-2026-65879. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn