SP Page Builder (com_sppagebuilder) 6.7.1 to 6.7.x - CVE-2026-67285 and CVE-2026-67286 Unauthenticated Remote Code Execution (PHP file inclusion, CVSS 9.3) plus CVE-2026-65876 Unauthenticated SQL Injection - fixed in 6.8.0
SP Page Builder 6.7.1 and earlier contain a pre-authentication remote code execution flaw and an unauthenticated SQL injection. Both are fixed in 6.8.0, released 12 August 2026. mySites.guru re-tested the released 6.8.0 package the same day and confirmed both are closed. Update to 6.8.0 or later now. 1) Unauthenticated PHP file inclusion, leading to remote code execution (CVE-2026-67285 / CVE-2026-67286, CVSS 4.0 9.3 Critical). The front-end task dynamic_content.loadMoreCollectionData renders an addon definition supplied in the request body itself. The addon name from that definition was concatenated into a filesystem path and then included and executed as PHP, with no directory traversal check. The endpoint is gated only by a CSRF token, which Joomla issues to every anonymous visitor, so it is reachable pre-authentication. An attacker could make the site execute a PHP file from any path the web server can read, inside or outside the web root, which becomes full remote code execution wherever any attacker-influenced PHP file exists. A second issue on the same endpoint let an anonymous request create a directory and write a file outside the cache folder, because the addon id was also used unchecked as a filesystem path. Reported privately to JoomShaper by mySites.guru on 27 July 2026 and confirmed by exploitation on a test install. The vulnerable code is present in 6.7.1 and, from testing, in every release back to 5.5.0 where Dynamic Content was introduced. 2) Unauthenticated SQL injection in the article loading endpoint (CVE-2026-65876). The task articles.loadMoreArticles read its parameters from the raw JSON request body with no login and no permission check, and passed catid unfiltered into a SQL IN() clause. The 6.7.1 release was credited with fixing this but did not: the integer sanitisation ran one line after the raw value had already reached the query. 6.8.0 applies the cast correctly. This one was not found by mySites.guru, but the incomplete 6.7.1 patch was confirmed by reading the shipping package on 10 August 2026 and the 6.8.0 fix was confirmed on 12 August 2026. Note that the 6.8.0 release notes describe the code execution fix only as "Hardened input validation, file handling, and access checks across the component", with no severity, no CVE and no indication of urgency. Treat this as a critical update regardless of how the changelog reads. Because the file inclusion allows code execution without a login, any site that ran a vulnerable version while internet-facing should be treated as potentially compromised until checked: look for unexpected files and administrator accounts, rotate the Joomla secret and stored credentials, and restore from a known-good backup if anything looks wrong. This is separate from CVE-2026-65766, the Dynamic Content ORDER BY injection, which was genuinely fixed in 6.7.1 and is covered by the 6.0.0 to 6.7.0 rule.
Affected versions: ≥ 6.7.1 and < 6.8.0
Full advisory: our disclosure post
SP Page Builder (com_sppagebuilder) 6.0.0 to 6.7.0 - CVE-2026-65766, CVE-2026-65876, CVE-2026-65877, CVE-2026-65878, CVE-2026-65879 - Unauthenticated SQL Injection (CVSS 9.2) and Open Mail Relay
Four vulnerabilities found by mySites.guru in SP Page Builder Pro 6.7.0 and reported privately to JoomShaper on 21 July 2026, fixed in 6.7.1 on 27 July 2026. The update applies to both the Pro and free editions. The Joomla CNA assigned four CVE IDs for these findings on 27 July 2026: CVE-2026-65766, CVE-2026-65877, CVE-2026-65878 and CVE-2026-65879. The records were still reserved rather than published at that point, so no per-finding mapping and no CNA scores are public yet. (1) Unauthenticated SQL injection (CWE-89, CVSS 4.0 8.7) in the Dynamic Content endpoint dynamic_content.getDynamicContentData: the sort direction was concatenated into the ORDER BY clause unchecked, and the endpoint was gated only by a CSRF token that Joomla issues to every anonymous visitor, so an anonymous attacker could read the entire database including password hashes. (2) Unauthenticated open mail relay (CWE-798) in the ajax_contact and form_builder addons: a single hardcoded salt shipped identically in every copy of the extension, so the signed recipient and sender could be forged offline, turning any site with a published contact form into a spam and phishing relay sending from its own domain and mail server. (3) Authenticated SQL injection in the media manager JSON view, reachable by a low-privilege author. (4) Authenticated arbitrary file delete via path traversal in the media delete action, needing only the create permission, allowing deletion of configuration.php or a protective .htaccess. Update to SP Page Builder 6.7.1 or later. There is no partial mitigation for the pre-authentication SQL injection other than updating. If a vulnerable version was internet-facing, treat the database as potentially read: rotate the Joomla secret and any stored API keys, and assume password hashes are known. Separate from CVE-2026-48908, the June 2026 unauthenticated icon-upload RCE fixed in 6.6.2. UPDATE 28 July 2026: the Joomla CNA published a fifth record for this release, CVE-2026-65876 (CVSS 4.0 9.2 CRITICAL, AV:N/AC:L/PR:N/UI:N) - an unauthenticated SQL injection caused by improper validation of the catid parameter in the loadMoreArticles endpoint, affecting all versions below 6.7.1. It is already covered by this rule; no version-boundary change was needed. Also within this rule: CVE-2026-66494 (unauthenticated stored XSS in the Shapes API endpoint, affecting 1.0.0 to 6.6.2), which sits below 6.7.1 and needs no separate row.
Affected versions: ≥ 6.0.0 and < 6.7.1
Full advisory: our disclosure post
SP Page Builder (com_sppagebuilder) 4.0.0 to 6.6.1 - CVE-2026-48908 (CVSS 10.0) Unauthenticated Arbitrary File Upload (RCE)
SP Page Builder by JoomShaper, from 4.0.0 up to and including 6.6.1, exposes an asset.uploadCustomIcon task that accepts a file with no login and no file-type check. An unauthenticated remote attacker can upload a PHP web shell to a web-served folder and execute it, giving full remote code execution (CWE-284 Improper Access Control, CVSS v4.0 10.0). This was a zero-day found being actively exploited in the wild; observed droppers read configuration.php for database credentials and insert a rogue admin user for persistence. JoomShaper shipped 6.6.2 on 14 June 2026, which gates the endpoint behind an authenticated session with component-manage permission and a valid anti-CSRF token. Update to 6.6.2 or later immediately and check the site for web shells and rogue users. The Joomla 3 branch of SP Page Builder (3.8.x and earlier) is NOT affected by this particular flaw: the controllers/asset.php file that carries the uploadCustomIcon task does not exist in that branch at all, which is why this rule starts at 4.0.0. A Joomla 3 site on SP Page Builder 3.x is still exposed to the separate addon local-file-include issue in components/com_sppagebuilder/controller.php, and that one is closed by the Unpatched JoomShaper Security Holes tool.
Affected versions: ≥ 4.0.0 and < 6.6.2
Full advisory: our disclosure post
SP Page Builder (com_sppagebuilder) 6.8.0 to 6.9.0 - CVE-2026-78375 Author-level SQL Injection (full database read, CVSS 8.6), CVE-2026-79700 and CVE-2026-79701 Unauthenticated Captcha Bypass, plus three authorisation flaws - fixed in 6.9.1
Five security issues found by mySites.guru in SP Page Builder 6.9.0 and reported privately to JoomShaper on 8 September 2026, all fixed in 6.9.1 on 14 September 2026. The Joomla CNA published six CVE records on 14 September 2026 (the captcha bypass is split into one record per route), each naming Phil Taylor, mysites.guru as the finder. Scores and weakness classes below are the published ones. NOTE: JoomShaper's 6.9.1 changelog transposes CVE-2026-81565 and CVE-2026-81566 against the published records. The records are the authority: 81565 is the media upload, 81566 is the menu item. Do not re-map these two from the vendor changelog.
1. Author-level blind SQL injection, CVE-2026-78375 (CVSS 4.0 8.6 High, CWE-89, published affected range 5.2.1 to 6.9.0). The com_content integration plugin reads a value from the article-save request without an integer cast and concatenates it into a query. Any account that can save an article, an Author on a default Joomla site, can read the entire database one character at a time, including the Super User password hash. Requires the SP Page Builder content plugin to be enabled, which it is on any site using the builder inside articles. The record scores PR:H, which in Joomla CNA practice means above Registered rather than administrator.
2. Unauthenticated captcha bypass, CVE-2026-79700 and CVE-2026-79701 (both CVSS 4.0 6.9 Medium, CWE-807; published affected ranges Pro 5.1.4 to 6.9.0 and Pro 3.2.6 to 6.9.0). The contact form, opt-in form and form builder addons discard the real captcha result whenever the request claims the form is rendered inside a module, and the opt-in form additionally compared two attacker-supplied values. An anonymous visitor defeats reCAPTCHA on any of the three. These addons ship only in SP Page Builder Pro, so the free Lite edition is not affected by this one.
3. Editor-level media file rename escaping the media folders, CVE-2026-81564 (CVSS 4.0 7.0 High, CWE-22, published affected range 4.0.0 to 6.9.0). Renaming a chosen file to a path outside the web root can take the site down.
4. Author-level file write into the web root media tree, CVE-2026-81565 (CVSS 4.0 6.9 Medium, CWE-22, published affected range 4.0.0 to 6.9.0). The upload endpoint took its destination folder from the request without confining it.
5. Editor-level Joomla menu takeover, CVE-2026-81566 (CVSS 4.0 5.1 Medium, CWE-284, published affected range 4.0.0 to 6.9.0). The add-to-menu action called the menu-item model directly with no com_menus permission check, so an Editor could create or overwrite menu items including the site home item. Update to SP Page Builder 6.9.1 or later. Joomla 3 sites cannot install 6.9.1: JoomShaper published a separate Joomla 3 Security Patch. Its first release, 1.0.2, back-ported four of the five fixes but left the captcha bypass (CVE-2026-79701, which the Joomla CNA is extending to the Joomla 3 branch) live and shipped an incomplete fix for a reflected XSS in the dynamic content filter addon (CVE-2026-102426, Joomla 3 branch only, the 6.x branch was never affected). Version 1.0.3, released 30 September 2026, closes both. It installs only over SP Page Builder 5.6.1 and does not change the component version, so patched and unpatched Joomla 3 sites are indistinguishable by version and are deliberately not covered by this rule; the mySites.guru JoomShaper Joomla 3 patch tool detects and deploys it instead.
Affected versions: ≥ 6.8.0 and < 6.9.1
Full advisory: our disclosure post
Running SP Page Builder on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
CVE identifiers: CVE-2026-67285, CVE-2026-67286, CVE-2026-67287, CVE-2026-65876, CVE-2026-65766, CVE-2026-65877, CVE-2026-66494, CVE-2026-65878, CVE-2026-65879, CVE-2026-48908, CVE-2026-78375, CVE-2026-79700, CVE-2026-79701, CVE-2026-81564, CVE-2026-81565, CVE-2026-81566. Rules current as of 3 October 2026.