Vulnary
← back to the feed
Critical· 9.2

CVE-2026-65766

An unauthenticated attacker can inject SQL into the SP Page Builder extension for Joomla, which is used by sites built with joomshaper.com. The flaw exists in versions older than 6.7.1 and allows the attacker to send crafted order parameters that are not properly validated.

publishedJul 27, 2026
last modifiedJul 27, 2026
sourcesNVD
severity · cvss
9.2
critical · how bad it is
exploitation · epss
<1%
15th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 10, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

Joomla sites using the SP Page Builder extension from joomshaper.com, version 6.7.0 or earlier.

02

Real-world impact

An attacker could read, modify, or delete data stored in the site’s database, potentially compromising user accounts, site content, and sensitive information.

03

Why this severity

The CVSS score of 9.2 reflects the lack of authentication required, the high impact on confidentiality and integrity, and the ease of exploitation via a simple HTTP request.

04

What to do about it

no official fix yet

No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.

No fix documented in sources

05

Timeline

06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsNone
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactNone
Availability impactNone
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →