Unpatched JoomShaper Security Holes

What this check and mySites.guru tool looks at on your site

JoomShaper ended Joomla 3 support across its products in July 2026, meaning no new features, no bug fixes and, initially, no security patches regardless of severity, for the Joomla 3 builds of Helix Ultimate, SP Page Builder and Helix3. Six days later the company reversed the security half of that decision and began shipping standalone Joomla 3 security packages for all three, the reversal covered in patching the abandoned JoomShaper Joomla 3 extensions. This check reads which of the three extensions is installed on a site, its version, and whether it already carries JoomShaper’s official Joomla 3 patch or is still exposed.

It matters because none of these packages change the extension’s version number in a way ordinary tools can see: the patched files report the same version string before and after, so Joomla’s Extensions manager, the update feed and a plain version inventory all read a patched site and an unpatched one identically. Confirming patch status needs to compare the installed files against what the vendor package actually contains, not just read a version number.

Fixes a Joomla 3 site cannot install

All three extensions had serious, unauthenticated flaws that mainline, supported Joomla (4 and above) already fixes, but a Joomla 3 site cannot install the mainline fix:

• SP Page Builder - fixes the unauthenticated custom-icon uploader, CVE-2026-48908, the arbitrary-file-upload-to-remote-code-execution hole behind the mass Joomla breaches of June 2026, the one that plants rogue Super Administrator accounts and thousands of rogue icon-font asset rows.
• Helix Ultimate - fixes upload hardening, ajax authorisation and CSRF gaps, path traversal in the media handlers, an open redirect, and the stored cross-site scripting holes in the mega-menu settings (CVE-2026-57829, CVE-2026-57830).
• Helix3 - closes the unauthenticated layout ajax actions that allowed arbitrary file write, read and delete and a template-settings database overwrite (CVE-2026-49049), and adds an image-upload extension allowlist, path confinement, admin authorisation and CSRF checks.

These are not theoretical. Every one of them has been used in real, automated attacks against Joomla sites, and a Joomla 3 site running any of the three without the vendor’s Joomla 3 patch is exposed to exactly the same holes as an unpatched Joomla 4 or 5 site.

The Joomla 3 packages are also incomplete relative to the mainline fix, by design, since they backport security work rather than rewrite the extension. JoomShaper’s third Helix Ultimate Joomla 3 release, for example, carries nine of the twelve security fixes in the current mainline version; missing items include a draft-cache identity fix and escaping on certain image layouts. Applying the current Joomla 3 patch closes the most serious holes, but it is not identical to running a fully supported version.

The vendor’s Joomla 3 patch, confirmed on disk

Every JoomShaper extension present on a Joomla 3 site, Helix Ultimate, Helix3, and SP Page Builder, carries the vendor’s current Joomla 3 security patch, confirmed against the files on disk rather than assumed from a version number that does not change.

How to fix it

1. Identify what you are running. In the administrator, go to System, then Manage, then Extensions, and check whether Helix Ultimate, Helix3 or SP Page Builder is installed, and its reported version.
2. Download JoomShaper’s official Joomla 3 package for each one installed. The Helix Ultimate and Helix3 patches are published on GitHub, on the j3-security-v1.0.0 release tag of each repository (JoomShaper’s own announcement points at the download but the link is often missing from the page, so go to the release tag directly). The SP Page Builder Joomla 3 patch is not on GitHub and comes from JoomShaper’s site download instead.
3. Install each package through Joomla’s normal installer. In the administrator, go to System, then Install, then Extensions, and upload the package as you would any other extension. The Helix Ultimate package removes its own extension record from Joomla once installed, which is expected.
4. Do not rely on the version number to confirm success. These packages patch files in place without bumping the version string, so check the file dates or re-run the installer rather than trusting what the Extensions manager reports.
5. If the site is already showing signs of compromise, deal with that first. Work through the site’s rogue-admin, mega-menu and template-code checks, then apply these patches so the same route cannot be used again.
6. Plan the migration. These patches buy time on Joomla 3, not permanence. Joomla 3 itself has had no core security patches since February 2025, so a genuinely current fix means moving to Joomla 5 or 6.

What mySites.guru does about it

mySites.guru can deploy JoomShaper’s official Joomla 3 security packages for all three extensions across every connected site with one click, through Joomla’s own installer, verified against a pinned checksum before install and with the affected plugin and template folders backed up first, so the change can be rolled back at any point. We also close one hole the official packages do not cover, a local file inclusion in the SP Page Builder 3.8.x addon action, with a small in-place guard of our own. Deploying the patches does not clean up a site that is already hacked; use the site’s other hacked-site checks first to find and remove anything an attacker already left behind.