# SP Page Builder (com_sppagebuilder) 6.0.0 to 6.7.0 - CVE-2026-65766, CVE-2026-65876, CVE-2026-65877, CVE-2026-65878, CVE-2026-65879 - Unauthenticated SQL Injection (CVSS 9.2) and Open Mail Relay [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-65766 CVE-2026-65766CriticalCVSS 9.2CVE published 27 July 2026Added to mySites.guru 27 July 2026 # SP Page Builder (com\_sppagebuilder) 6.0.0 to 6.7.0 - CVE-2026-65766, CVE-2026-65876, CVE-2026-65877, CVE-2026-65878, CVE-2026-65879 - Unauthenticated SQL Injection (CVSS 9.2) and Open Mail Relay Four vulnerabilities found by mySites.guru in SP Page Builder Pro 6.7.0 and reported privately to JoomShaper on 21 July 2026, fixed in 6.7.1 on 27 July 2026. The update applies to both the Pro and free editions. The Joomla CNA assigned four CVE IDs for these findings on 27 July 2026: CVE-2026-65766, CVE-2026-65877, CVE-2026-65878 and CVE-2026-65879. The records were still reserved rather than published at that point, so no per-finding mapping and no CNA scores are public yet. (1) Unauthenticated SQL injection (CWE-89, CVSS 4.0 8.7) in the Dynamic Content endpoint dynamic\_content.getDynamicContentData: the sort direction was concatenated into the ORDER BY clause unchecked, and the endpoint was gated only by a CSRF token that Joomla issues to every anonymous visitor, so an anonymous attacker could read the entire database including password hashes. (2) Unauthenticated open mail relay (CWE-798) in the ajax\_contact and form\_builder addons: a single hardcoded salt shipped identically in every copy of the extension, so the signed recipient and sender could be forged offline, turning any site with a published contact form into a spam and phishing relay sending from its own domain and mail server. (3) Authenticated SQL injection in the media manager JSON view, reachable by a low-privilege author. (4) Authenticated arbitrary file delete via path traversal in the media delete action, needing only the create permission, allowing deletion of configuration.php or a protective .htaccess. Update to SP Page Builder 6.7.1 or later. There is no partial mitigation for the pre-authentication SQL injection other than updating. If a vulnerable version was internet-facing, treat the database as potentially read: rotate the Joomla secret and any stored API keys, and assume password hashes are known. Separate from CVE-2026-48908, the June 2026 unauthenticated icon-upload RCE fixed in 6.6.2. UPDATE 28 July 2026: the Joomla CNA published a fifth record for this release, CVE-2026-65876 (CVSS 4.0 9.2 CRITICAL, AV:N/AC:L/PR:N/UI:N) - an unauthenticated SQL injection caused by improper validation of the catid parameter in the loadMoreArticles endpoint, affecting all versions below 6.7.1. It is already covered by this rule; no version-boundary change was needed. Also within this rule: CVE-2026-66494 (unauthenticated stored XSS in the Shapes API endpoint, affecting 1.0.0 to 6.6.2), which sits below 6.7.1 and needs no separate row. Copy citation ## Is my site affected? - **Affected** - SP Page Builder from 6.0.0 up to but not including 6.7.1 - **Fixed in** - 6.7.1 - **What to do** - Update SP Page Builder to 6.7.1 for this flaw, or to 6.9.1 or later, which no rule we check matches. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## How CVE-2026-65766 is scored The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw. 9.2 Critical CVSS 4.0, scored by Joomla CNA `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N` ### How it is reached - **AV:N Attack vector** - Network. Reachable across the internet - **AC:L Attack complexity** - Low. Nothing to work around, it just works - **AT:N Attack requirements** - None. Works against any affected install - **PR:N Privileges required** - None. No account needed - **UI:N User interaction** - None. Nobody has to be tricked into anything ### What it does to the site - **VC:H Confidentiality** - High. Everything the site holds can be read - **VI:N Integrity** - None. Nothing can be altered - **VA:N Availability** - None. The site stays up ### What it does beyond the site - **SC:H Confidentiality** - High. Data on other systems can be read - **SI:N Integrity** - None. Other systems keep their integrity - **SA:N Availability** - None. Other systems stay up ## Timeline 1. 27 July 2026CVE-2026-65766 record published by its CNA 2. 27 July 2026mySites.guru check added for SP Page Builder (from 6.0.0 up to but not including 6.7.1) 3. 27 July 2026[We published: Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru](https://mysites.guru/blog/sp-page-builder-sql-injection-mail-relay-disclosure/) ## Rule details Critical[CVE-2026-65876](https://mysites.guru/vulnerabilities/CVE-2026-65876/)[CVE-2026-65766](https://mysites.guru/vulnerabilities/CVE-2026-65766/)[CVE-2026-65877](https://mysites.guru/vulnerabilities/CVE-2026-65877/)[CVE-2026-66494](https://mysites.guru/vulnerabilities/CVE-2026-66494/)[CVE-2026-65878](https://mysites.guru/vulnerabilities/CVE-2026-65878/)[CVE-2026-65879](https://mysites.guru/vulnerabilities/CVE-2026-65879/)2026-07-27 [SP Page Builder](https://mysites.guru/vulnerabilities/sppagebuilder/) Affected versions: ≥ 6.0.0 and < 6.7.1 Full advisory: [our disclosure post](https://mysites.guru/blog/sp-page-builder-sql-injection-mail-relay-disclosure/) ## Our disclosure post [![Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru](https://mysites.guru/_astro/sp-page-builder-sql-injection-mail-relay-disclosure.BKiyO6WP_1FcgLL.webp) ### Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru mySites.guru found four vulnerabilities in SP Page Builder for Joomla: a SQL injection and a mail relay, fixed in 6.7.1. A fifth was still there until 6.8.0. 27 Jul 2026 ](https://mysites.guru/blog/sp-page-builder-sql-injection-mail-relay-disclosure/) ## Other vulnerabilities in SP Page Builder Updating for CVE-2026-65766 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension. ### [SP Page Builder](https://mysites.guru/vulnerabilities/sppagebuilder/) Latest safe version: 6.9.1 - [CVE-2026-67285](https://mysites.guru/vulnerabilities/CVE-2026-67285/) Critical, from 6.7.1 up to but not including 6.8.0 - [CVE-2026-67286](https://mysites.guru/vulnerabilities/CVE-2026-67286/) Critical, from 6.7.1 up to but not including 6.8.0 - [CVE-2026-67287](https://mysites.guru/vulnerabilities/CVE-2026-67287/) Critical, from 6.7.1 up to but not including 6.8.0 - [CVE-2026-65876](https://mysites.guru/vulnerabilities/CVE-2026-65876/) Critical, from 6.7.1 up to but not including 6.8.0 - [CVE-2026-65877](https://mysites.guru/vulnerabilities/CVE-2026-65877/) Critical, from 6.0.0 up to but not including 6.7.1 - [CVE-2026-66494](https://mysites.guru/vulnerabilities/CVE-2026-66494/) Critical, from 6.0.0 up to but not including 6.7.1 - [CVE-2026-65878](https://mysites.guru/vulnerabilities/CVE-2026-65878/) Critical, from 6.0.0 up to but not including 6.7.1 - [CVE-2026-65879](https://mysites.guru/vulnerabilities/CVE-2026-65879/) Critical, from 6.0.0 up to but not including 6.7.1 [All 17 CVEs in SP Page Builder](https://mysites.guru/vulnerabilities/sppagebuilder/) ## References - [CVE-2026-65766 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-65766) - [CVE-2026-65766 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-65766) - [Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru](https://mysites.guru/blog/sp-page-builder-sql-injection-mail-relay-disclosure/) ## CVE-2026-65766 questions Show all Which versions are affected by CVE-2026-65766? [CVE-2026-65766](https://mysites.guru/vulnerabilities/CVE-2026-65766/) affects SP Page Builder from 6.0.0 up to but not including 6.7.1. The fix is in 6.7.1. How do I fix CVE-2026-65766? Update SP Page Builder to 6.7.1 for this flaw, or to 6.9.1 or later, which no rule we check matches. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen. How severe is CVE-2026-65766? Joomla CNA scores it 9.2 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything. ## Running an affected version on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). Rules current as of 14 October 2026.