CVE-2026-65879
CVE-2026-65879 is a critical vulnerability (CVSS 9.8) in the SP Page Builder extension for Joomla, affecting versions before 6.7.1. A hardcoded, product-wide secret allows unauthenticated attackers to relay email by forging the mail-from address of forms, potentially leading to spam or phishing. The flaw stems from CWE-798 (use of hardcoded credentials).
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of the SP Page Builder Joomla extension from joomshaper.com running versions prior to 6.7.1.
Real-world impact
An attacker can send arbitrary emails through the site's mail system, enabling spam, phishing, or malware distribution without authentication.
Why this severity
The CVSS score of 9.8 reflects network‑adjacent attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources