Affected versions: ≥ 6.7.1 and < 6.8.0
Full advisory: our disclosure post
CVE-2026-65876CriticalPublished 12 August 2026
SP Page Builder (com_sppagebuilder) 6.7.1 to 6.7.x - CVE-2026-67285 and CVE-2026-67286 Unauthenticated Remote Code Execution (PHP file inclusion, CVSS 9.3) plus CVE-2026-65876 Unauthenticated SQL Injection - fixed in 6.8.0
SP Page Builder 6.7.1 and earlier contain a pre-authentication remote code execution flaw and an unauthenticated SQL injection. Both are fixed in 6.8.0, released 12 August 2026. mySites.guru re-tested the released 6.8.0 package the same day and confirmed both are closed. Update to 6.8.0 or later now. 1) Unauthenticated PHP file inclusion, leading to remote code execution (CVE-2026-67285 / CVE-2026-67286, CVSS 4.0 9.3 Critical). The front-end task dynamic_content.loadMoreCollectionData renders an addon definition supplied in the request body itself. The addon name from that definition was concatenated into a filesystem path and then included and executed as PHP, with no directory traversal check. The endpoint is gated only by a CSRF token, which Joomla issues to every anonymous visitor, so it is reachable pre-authentication. An attacker could make the site execute a PHP file from any path the web server can read, inside or outside the web root, which becomes full remote code execution wherever any attacker-influenced PHP file exists. A second issue on the same endpoint let an anonymous request create a directory and write a file outside the cache folder, because the addon id was also used unchecked as a filesystem path. Reported privately to JoomShaper by mySites.guru on 27 July 2026 and confirmed by exploitation on a test install. The vulnerable code is present in 6.7.1 and, from testing, in every release back to 5.5.0 where Dynamic Content was introduced. 2) Unauthenticated SQL injection in the article loading endpoint (CVE-2026-65876). The task articles.loadMoreArticles read its parameters from the raw JSON request body with no login and no permission check, and passed catid unfiltered into a SQL IN() clause. The 6.7.1 release was credited with fixing this but did not: the integer sanitisation ran one line after the raw value had already reached the query. 6.8.0 applies the cast correctly. This one was not found by mySites.guru, but the incomplete 6.7.1 patch was confirmed by reading the shipping package on 10 August 2026 and the 6.8.0 fix was confirmed on 12 August 2026. Note that the 6.8.0 release notes describe the code execution fix only as "Hardened input validation, file handling, and access checks across the component", with no severity, no CVE and no indication of urgency. Treat this as a critical update regardless of how the changelog reads. Because the file inclusion allows code execution without a login, any site that ran a vulnerable version while internet-facing should be treated as potentially compromised until checked: look for unexpected files and administrator accounts, rotate the Joomla secret and stored credentials, and restore from a known-good backup if anything looks wrong. This is separate from CVE-2026-65766, the Dynamic Content ORDER BY injection, which was genuinely fixed in 6.7.1 and is covered by the 6.0.0 to 6.7.0 rule.
Affected versions: ≥ 6.7.1 and < 6.8.0
Official record: cve.org · NVD
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
Affected extensions and versions
CriticalCVE-2026-65876CVE-2026-65766CVE-2026-65877CVE-2026-66494CVE-2026-65878CVE-2026-658792026-07-27
SP Page Builder - SP Page Builder (com_sppagebuilder) 6.0.0 to 6.7.0 - CVE-2026-65766, CVE-2026-65876, CVE-2026-65877, CVE-2026-65878, CVE-2026-65879 - Unauthenticated SQL Injection (CVSS 9.2) and Open Mail Relay
Four vulnerabilities found by mySites.guru in SP Page Builder Pro 6.7.0 and reported privately to JoomShaper on 21 July 2026, fixed in 6.7.1 on 27 July 2026. The update applies to both the Pro and free editions. The Joomla CNA assigned four CVE IDs for these findings on 27 July 2026: CVE-2026-65766, CVE-2026-65877, CVE-2026-65878 and CVE-2026-65879. The records were still reserved rather than published at that point, so no per-finding mapping and no CNA scores are public yet. (1) Unauthenticated SQL injection (CWE-89, CVSS 4.0 8.7) in the Dynamic Content endpoint dynamic_content.getDynamicContentData: the sort direction was concatenated into the ORDER BY clause unchecked, and the endpoint was gated only by a CSRF token that Joomla issues to every anonymous visitor, so an anonymous attacker could read the entire database including password hashes. (2) Unauthenticated open mail relay (CWE-798) in the ajax_contact and form_builder addons: a single hardcoded salt shipped identically in every copy of the extension, so the signed recipient and sender could be forged offline, turning any site with a published contact form into a spam and phishing relay sending from its own domain and mail server. (3) Authenticated SQL injection in the media manager JSON view, reachable by a low-privilege author. (4) Authenticated arbitrary file delete via path traversal in the media delete action, needing only the create permission, allowing deletion of configuration.php or a protective .htaccess. Update to SP Page Builder 6.7.1 or later. There is no partial mitigation for the pre-authentication SQL injection other than updating. If a vulnerable version was internet-facing, treat the database as potentially read: rotate the Joomla secret and any stored API keys, and assume password hashes are known. Separate from CVE-2026-48908, the June 2026 unauthenticated icon-upload RCE fixed in 6.6.2. UPDATE 28 July 2026: the Joomla CNA published a fifth record for this release, CVE-2026-65876 (CVSS 4.0 9.2 CRITICAL, AV:N/AC:L/PR:N/UI:N) - an unauthenticated SQL injection caused by improper validation of the catid parameter in the loadMoreArticles endpoint, affecting all versions below 6.7.1. It is already covered by this rule; no version-boundary change was needed. Also within this rule: CVE-2026-66494 (unauthenticated stored XSS in the Shapes API endpoint, affecting 1.0.0 to 6.6.2), which sits below 6.7.1 and needs no separate row.
Affected versions: ≥ 6.0.0 and < 6.7.1
Full advisory: our disclosure post
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 14 September 2026.