CVE-2026-65766
An unauthenticated attacker can inject SQL into the SP Page Builder extension for Joomla, which is used by sites built with joomshaper.com. The flaw exists in versions older than 6.7.1 and allows the attacker to send crafted order parameters that are not properly validated.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Joomla sites using the SP Page Builder extension from joomshaper.com, version 6.7.0 or earlier.
Real-world impact
An attacker could read, modify, or delete data stored in the site’s database, potentially compromising user accounts, site content, and sensitive information.
Why this severity
The CVSS score of 9.2 reflects the lack of authentication required, the high impact on confidentiality and integrity, and the ease of exploitation via a simple HTTP request.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources