JoomShaper’s SP Property extension shipped a critical unauthenticated SQL injection tracked as CVE-2026-78082. Vendor severity sits at CVSS 9.3. Affected releases are everything before 4.1.4.
What broke
Property search and map filtering built WHERE and ORDER BY clauses by concatenating raw request parameters — including zipcode, sorting, price_range_dropdown, and psize_range_dropdown — straight into SQL. No quoting. No type casting.
That means an unauthenticated visitor who can hit those public endpoints can run boolean-based or time-based blind SQL injection and pull data out of the database. No account. No admin click.
Who should care
Any agency or in-house team running Joomla sites with SP Property under 4.1.4, especially listings that expose search or map filters on the front end. One forgotten client site is enough.
What to do today
- Inventory every Joomla site that has SP Property installed.
- Confirm the extension version in the admin. Anything below 4.1.4 is vulnerable.
- Update to 4.1.4 or later as soon as you can.
- If you cannot patch in the next few hours, restrict or disable public property search and map filtering until the update lands. WAF rules that block the risky parameters are a temporary bridge, not a substitute for the vendor fix.
Why fleets make this harder
Logging into twenty admin panels to check one extension version is how things get missed. The sites that still run last year’s property template are usually the ones you have not opened this month.
CMS Inspect is built for that loop: WordPress and Joomla together, extension visibility, safer update workflows with a clearer audit trail, Drive or Dropbox database backups, and security triage so the queue stays high-signal. Core access is free; advanced ops are $1 per active site per month.
If SP Property is on any of your Joomla clients, check the version before lunch — then patch or lock the search endpoints down until you can.
