Affected versions: ≥ 6.7.1 and < 6.8.0
Full advisory: our disclosure post
CVE-2026-65876CriticalCVSS 9.2CVE published 27 July 2026Added to mySites.guru 12 August 2026
SP Page Builder (com_sppagebuilder) 6.7.1 to 6.7.x - CVE-2026-67285 and CVE-2026-67286 Unauthenticated Remote Code Execution (PHP file inclusion, CVSS 9.3) plus CVE-2026-65876 Unauthenticated SQL Injection - fixed in 6.8.0
SP Page Builder 6.7.1 and earlier contain a pre-authentication remote code execution flaw and an unauthenticated SQL injection. Both are fixed in 6.8.0, released 12 August 2026. mySites.guru re-tested the released 6.8.0 package the same day and confirmed both are closed. Update to 6.8.0 or later now. 1) Unauthenticated PHP file inclusion, leading to remote code execution (CVE-2026-67285 / CVE-2026-67286, CVSS 4.0 9.3 Critical). The front-end task dynamic_content.loadMoreCollectionData renders an addon definition supplied in the request body itself. The addon name from that definition was concatenated into a filesystem path and then included and executed as PHP, with no directory traversal check. The endpoint is gated only by a CSRF token, which Joomla issues to every anonymous visitor, so it is reachable pre-authentication. An attacker could make the site execute a PHP file from any path the web server can read, inside or outside the web root, which becomes full remote code execution wherever any attacker-influenced PHP file exists. A second issue on the same endpoint let an anonymous request create a directory and write a file outside the cache folder, because the addon id was also used unchecked as a filesystem path. Reported privately to JoomShaper by mySites.guru on 27 July 2026 and confirmed by exploitation on a test install. The vulnerable code is present in 6.7.1 and, from testing, in every release back to 5.5.0 where Dynamic Content was introduced. 2) Unauthenticated SQL injection in the article loading endpoint (CVE-2026-65876). The task articles.loadMoreArticles read its parameters from the raw JSON request body with no login and no permission check, and passed catid unfiltered into a SQL IN() clause. The 6.7.1 release was credited with fixing this but did not: the integer sanitisation ran one line after the raw value had already reached the query. 6.8.0 applies the cast correctly. This one was not found by mySites.guru, but the incomplete 6.7.1 patch was confirmed by reading the shipping package on 10 August 2026 and the 6.8.0 fix was confirmed on 12 August 2026. Note that the 6.8.0 release notes describe the code execution fix only as "Hardened input validation, file handling, and access checks across the component", with no severity, no CVE and no indication of urgency. Treat this as a critical update regardless of how the changelog reads. Because the file inclusion allows code execution without a login, any site that ran a vulnerable version while internet-facing should be treated as potentially compromised until checked: look for unexpected files and administrator accounts, rotate the Joomla secret and stored credentials, and restore from a known-good backup if anything looks wrong. This is separate from CVE-2026-65766, the Dynamic Content ORDER BY injection, which was genuinely fixed in 6.7.1 and is covered by the 6.0.0 to 6.7.0 rule.
Is my site affected?
CVE-2026-65876 is checked by 2 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| SP Page Builder | from 6.7.1 up to but not including 6.8.0 | 6.8.0 | Update SP Page Builder to 6.8.0 for this flaw, or to 6.9.1 or later, which no rule we check matches. |
| SP Page Builder | from 6.0.0 up to but not including 6.7.1 | 6.7.1 | Update SP Page Builder to 6.7.1 for this flaw, or to 6.9.1 or later, which no rule we check matches. |
How CVE-2026-65876 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
9.2 Critical
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:H Confidentiality
- High. Everything the site holds can be read
- VI:N Integrity
- None. Nothing can be altered
- VA:N Availability
- None. The site stays up
What it does beyond the site
- SC:H Confidentiality
- High. Data on other systems can be read
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
Timeline
- 27 July 2026CVE-2026-65876 record published by its CNA
- 27 July 2026mySites.guru check added for SP Page Builder (from 6.0.0 up to but not including 6.7.1)
- 27 July 2026We published: Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru
- 12 August 2026mySites.guru check added for SP Page Builder (from 6.7.1 up to but not including 6.8.0)
Rule details
CriticalCVE-2026-65876CVE-2026-65766CVE-2026-65877CVE-2026-66494CVE-2026-65878CVE-2026-658792026-07-27
SP Page Builder - SP Page Builder (com_sppagebuilder) 6.0.0 to 6.7.0 - CVE-2026-65766, CVE-2026-65876, CVE-2026-65877, CVE-2026-65878, CVE-2026-65879 - Unauthenticated SQL Injection (CVSS 9.2) and Open Mail Relay
Four vulnerabilities found by mySites.guru in SP Page Builder Pro 6.7.0 and reported privately to JoomShaper on 21 July 2026, fixed in 6.7.1 on 27 July 2026. The update applies to both the Pro and free editions. The Joomla CNA assigned four CVE IDs for these findings on 27 July 2026: CVE-2026-65766, CVE-2026-65877, CVE-2026-65878 and CVE-2026-65879. The records were still reserved rather than published at that point, so no per-finding mapping and no CNA scores are public yet. (1) Unauthenticated SQL injection (CWE-89, CVSS 4.0 8.7) in the Dynamic Content endpoint dynamic_content.getDynamicContentData: the sort direction was concatenated into the ORDER BY clause unchecked, and the endpoint was gated only by a CSRF token that Joomla issues to every anonymous visitor, so an anonymous attacker could read the entire database including password hashes. (2) Unauthenticated open mail relay (CWE-798) in the ajax_contact and form_builder addons: a single hardcoded salt shipped identically in every copy of the extension, so the signed recipient and sender could be forged offline, turning any site with a published contact form into a spam and phishing relay sending from its own domain and mail server. (3) Authenticated SQL injection in the media manager JSON view, reachable by a low-privilege author. (4) Authenticated arbitrary file delete via path traversal in the media delete action, needing only the create permission, allowing deletion of configuration.php or a protective .htaccess. Update to SP Page Builder 6.7.1 or later. There is no partial mitigation for the pre-authentication SQL injection other than updating. If a vulnerable version was internet-facing, treat the database as potentially read: rotate the Joomla secret and any stored API keys, and assume password hashes are known. Separate from CVE-2026-48908, the June 2026 unauthenticated icon-upload RCE fixed in 6.6.2. UPDATE 28 July 2026: the Joomla CNA published a fifth record for this release, CVE-2026-65876 (CVSS 4.0 9.2 CRITICAL, AV:N/AC:L/PR:N/UI:N) - an unauthenticated SQL injection caused by improper validation of the catid parameter in the loadMoreArticles endpoint, affecting all versions below 6.7.1. It is already covered by this rule; no version-boundary change was needed. Also within this rule: CVE-2026-66494 (unauthenticated stored XSS in the Shapes API endpoint, affecting 1.0.0 to 6.6.2), which sits below 6.7.1 and needs no separate row.
Affected versions: ≥ 6.0.0 and < 6.7.1
Full advisory: our disclosure post
Our disclosure post
Other vulnerabilities in SP Page Builder
Updating for CVE-2026-65876 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
SP Page Builder
Latest safe version: 6.9.1
- CVE-2026-67285 Critical, from 6.7.1 up to but not including 6.8.0
- CVE-2026-67286 Critical, from 6.7.1 up to but not including 6.8.0
- CVE-2026-67287 Critical, from 6.7.1 up to but not including 6.8.0
- CVE-2026-65766 Critical, from 6.0.0 up to but not including 6.7.1
- CVE-2026-65877 Critical, from 6.0.0 up to but not including 6.7.1
- CVE-2026-66494 Critical, from 6.0.0 up to but not including 6.7.1
- CVE-2026-65878 Critical, from 6.0.0 up to but not including 6.7.1
- CVE-2026-65879 Critical, from 6.0.0 up to but not including 6.7.1
References
- CVE-2026-65876 on cve.org (the official CVE record)
- CVE-2026-65876 in the NIST National Vulnerability Database
- Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru
CVE-2026-65876 questions
Which versions are affected by CVE-2026-65876?
CVE-2026-65876 is covered by 2 rules: SP Page Builder from 6.7.1 up to but not including 6.8.0; SP Page Builder from 6.0.0 up to but not including 6.7.1.
How do I fix CVE-2026-65876?
It depends on the extension and release line your site runs. For SP Page Builder from 6.7.1 up to but not including 6.8.0: update SP Page Builder to 6.8.0 for this flaw, or to 6.9.1 or later, which no rule we check matches. For SP Page Builder from 6.0.0 up to but not including 6.7.1: update SP Page Builder to 6.7.1 for this flaw, or to 6.9.1 or later, which no rule we check matches.
How severe is CVE-2026-65876?
Joomla CNA scores it 9.2 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 October 2026.