Skip to main content
mySites.guru
Free Audit
New features added last monthRelease RadarFile ManagerImpostor FilesUpdate QueueRogue AdminsMCP & APIJoomla VELCVE Index
CVE-2026-65879CriticalCVSS 9.8CVE published 27 July 2026Added to mySites.guru 27 July 2026

SP Page Builder (com_sppagebuilder) 6.0.0 to 6.7.0 - CVE-2026-65766, CVE-2026-65876, CVE-2026-65877, CVE-2026-65878, CVE-2026-65879 - Unauthenticated SQL Injection (CVSS 9.2) and Open Mail Relay

Four vulnerabilities found by mySites.guru in SP Page Builder Pro 6.7.0 and reported privately to JoomShaper on 21 July 2026, fixed in 6.7.1 on 27 July 2026. The update applies to both the Pro and free editions. The Joomla CNA assigned four CVE IDs for these findings on 27 July 2026: CVE-2026-65766, CVE-2026-65877, CVE-2026-65878 and CVE-2026-65879. The records were still reserved rather than published at that point, so no per-finding mapping and no CNA scores are public yet. (1) Unauthenticated SQL injection (CWE-89, CVSS 4.0 8.7) in the Dynamic Content endpoint dynamic_content.getDynamicContentData: the sort direction was concatenated into the ORDER BY clause unchecked, and the endpoint was gated only by a CSRF token that Joomla issues to every anonymous visitor, so an anonymous attacker could read the entire database including password hashes. (2) Unauthenticated open mail relay (CWE-798) in the ajax_contact and form_builder addons: a single hardcoded salt shipped identically in every copy of the extension, so the signed recipient and sender could be forged offline, turning any site with a published contact form into a spam and phishing relay sending from its own domain and mail server. (3) Authenticated SQL injection in the media manager JSON view, reachable by a low-privilege author. (4) Authenticated arbitrary file delete via path traversal in the media delete action, needing only the create permission, allowing deletion of configuration.php or a protective .htaccess. Update to SP Page Builder 6.7.1 or later. There is no partial mitigation for the pre-authentication SQL injection other than updating. If a vulnerable version was internet-facing, treat the database as potentially read: rotate the Joomla secret and any stored API keys, and assume password hashes are known. Separate from CVE-2026-48908, the June 2026 unauthenticated icon-upload RCE fixed in 6.6.2. UPDATE 28 July 2026: the Joomla CNA published a fifth record for this release, CVE-2026-65876 (CVSS 4.0 9.2 CRITICAL, AV:N/AC:L/PR:N/UI:N) - an unauthenticated SQL injection caused by improper validation of the catid parameter in the loadMoreArticles endpoint, affecting all versions below 6.7.1. It is already covered by this rule; no version-boundary change was needed. Also within this rule: CVE-2026-66494 (unauthenticated stored XSS in the Shapes API endpoint, affecting 1.0.0 to 6.6.2), which sits below 6.7.1 and needs no separate row.

Is my site affected?

Affected
SP Page Builder from 6.0.0 up to but not including 6.7.1
Fixed in
6.7.1
What to do
Update SP Page Builder to 6.7.1 for this flaw, or to 6.9.1 or later, which no rule we check matches.
Check whether your sites are affected

How CVE-2026-65879 is scored

The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

9.8 Critical

CVSS 3.1, scored by CISA-ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

How it is reached

AV:N Attack vector
Network. Reachable across the internet
AC:L Attack complexity
Low. Nothing to work around, it just works
PR:N Privileges required
None. No account needed
UI:N User interaction
None. Nobody has to be tricked into anything
S:U Scope
Unchanged. Contained to the extension it is in

What it does

C:H Confidentiality
High. Everything the site holds can be read
I:H Integrity
High. Data and files can be altered at will
A:H Availability
High. The site can be taken down

Timeline

  1. 27 July 2026CVE-2026-65879 record published by its CNA
  2. 27 July 2026mySites.guru check added for SP Page Builder (from 6.0.0 up to but not including 6.7.1)
  3. 27 July 2026We published: Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru

Rule details

Our disclosure post

Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru

Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru

mySites.guru found four vulnerabilities in SP Page Builder for Joomla: a SQL injection and a mail relay, fixed in 6.7.1. A fifth was still there until 6.8.0.

Other vulnerabilities in SP Page Builder

Updating for CVE-2026-65879 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

SP Page Builder

Latest safe version: 6.9.1

All 17 CVEs in SP Page Builder

References

CVE-2026-65879 questions

Which versions are affected by CVE-2026-65879?
CVE-2026-65879 affects SP Page Builder from 6.0.0 up to but not including 6.7.1. The fix is in 6.7.1.
How do I fix CVE-2026-65879?
Update SP Page Builder to 6.7.1 for this flaw, or to 6.9.1 or later, which no rule we check matches. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2026-65879?
CISA-ADP scores it 9.8 (Critical) under CVSS 3.1. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 11 October 2026.