CVE-2026-65876
A Joomla extension called SP Page Builder from joomshaper.com contains a critical SQL injection flaw. Attackers can send crafted requests to the loadMoreArticles endpoint without authentication, allowing them to inject SQL code. This could let them read, modify, or delete data in the database.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Joomla sites that use the SP Page Builder extension from joomshaper.com with a version older than 6.7.1. Site administrators who have installed this extension are the typical users.
Real-world impact
An attacker could read, modify, or delete database contents, potentially compromising the entire website and exposing sensitive data.
Why this severity
The CVSS score of 9.2 reflects the high impact of the vulnerability: it is remotely exploitable without authentication, requires no user interaction, and can lead to full database compromise. The lack of mitigations and the high confidentiality impact contribute to the critical rating.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources