Affected versions: ≥ 6.7.1 and < 6.8.0
Full advisory: our disclosure post
CVE-2026-67287
SP Page Builder (com_sppagebuilder) 6.7.1 to 6.7.x - CVE-2026-67285 and CVE-2026-67286 Unauthenticated Remote Code Execution (PHP file inclusion, CVSS 9.3) plus CVE-2026-65876 Unauthenticated SQL Injection - fixed in 6.8.0
SP Page Builder 6.7.1 and earlier contain a pre-authentication remote code execution flaw and an unauthenticated SQL injection. Both are fixed in 6.8.0, released 12 August 2026. mySites.guru re-tested the released 6.8.0 package the same day and confirmed both are closed. Update to 6.8.0 or later now. 1) Unauthenticated PHP file inclusion, leading to remote code execution (CVE-2026-67285 / CVE-2026-67286, CVSS 4.0 9.3 Critical). The front-end task dynamic_content.loadMoreCollectionData renders an addon definition supplied in the request body itself. The addon name from that definition was concatenated into a filesystem path and then included and executed as PHP, with no directory traversal check. The endpoint is gated only by a CSRF token, which Joomla issues to every anonymous visitor, so it is reachable pre-authentication. An attacker could make the site execute a PHP file from any path the web server can read, inside or outside the web root, which becomes full remote code execution wherever any attacker-influenced PHP file exists. A second issue on the same endpoint let an anonymous request create a directory and write a file outside the cache folder, because the addon id was also used unchecked as a filesystem path. Reported privately to JoomShaper by mySites.guru on 27 July 2026 and confirmed by exploitation on a test install. The vulnerable code is present in 6.7.1 and, from testing, in every release back to 5.5.0 where Dynamic Content was introduced. 2) Unauthenticated SQL injection in the article loading endpoint (CVE-2026-65876). The task articles.loadMoreArticles read its parameters from the raw JSON request body with no login and no permission check, and passed catid unfiltered into a SQL IN() clause. The 6.7.1 release was credited with fixing this but did not: the integer sanitisation ran one line after the raw value had already reached the query. 6.8.0 applies the cast correctly. This one was not found by mySites.guru, but the incomplete 6.7.1 patch was confirmed by reading the shipping package on 10 August 2026 and the 6.8.0 fix was confirmed on 12 August 2026. Note that the 6.8.0 release notes describe the code execution fix only as "Hardened input validation, file handling, and access checks across the component", with no severity, no CVE and no indication of urgency. Treat this as a critical update regardless of how the changelog reads. Because the file inclusion allows code execution without a login, any site that ran a vulnerable version while internet-facing should be treated as potentially compromised until checked: look for unexpected files and administrator accounts, rotate the Joomla secret and stored credentials, and restore from a known-good backup if anything looks wrong. This is separate from CVE-2026-65766, the Dynamic Content ORDER BY injection, which was genuinely fixed in 6.7.1 and is covered by the 6.0.0 to 6.7.0 rule.
Affected versions: ≥ 6.7.1 and < 6.8.0
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 30 August 2026.