Critical Vulnerabilities in SP Page Builder: Update to Version 6.7.1

On July 27, 2026, four critical vulnerabilities were discovered in the popular SP Page Builder (com_sppagebuilder) page builder component. These include an unauthenticated SQL injection allowing attackers to read the entire site database, and an open mail relay turning your site into a spam platform.

The vulnerabilities have been assigned CVE-2026-65766, CVE-2026-65877, CVE-2026-65878, and CVE-2026-65879. The most severe of these — CVE-2026-65766 — has a CVSS 4.0 score of 9.2 (Critical).

JoomShaper developers released a fix in version 6.7.1 on July 27, 2026. This update is critically urgent — delaying the patch will lead to the exposure of all your site data, including password hashes, and allow your server to be used for spam distribution.

Understanding the Threat: What Was Fixed?

This update addresses four vulnerabilities affecting different components of the extension:

• Unauthenticated SQL Injection (CVE-2026-65766): The Dynamic Content endpoint accepted a direction parameter and inserted it directly into the ORDER BY clause without any validation. The only protection was a CSRF token, but Joomla issues tokens to all visitors, including anonymous ones, making this attack effectively unauthenticated. An attacker could read any database table: user accounts, password hashes, the site secret key, and all content.
• Open Mail Relay via Hardcoded Secret (CVE-2026-65879): The contact form addons used a hardcoded secret embedded in the code to sign the recipient address. Since this secret was identical for all copies of the extension, anyone with a copy of SP Page Builder could read it and forge a valid signature. This allowed sending emails from any site to any address with a spoofed sender, turning your server into a spam relay.
• Authenticated SQL Injection (CVE-2026-65877): The media manager's search and date filters also inserted request parameters into the SQL query without escaping. Exploitation required an author account, but still allowed reading the database.
• Arbitrary File Deletion (CVE-2026-65878): The media manager deleted files at a path supplied in the request without checking for directory traversal. An author could delete configuration.php or .htaccess, breaking the site and weakening its security.

Who Is at Risk?

All sites running SP Page Builder versions below 6.7.1 are at risk, including all versions from 1.0.0 through 6.7.0.

How to Fix It: Step-by-Step Instructions

To address these vulnerabilities, follow the steps below.

Step 1: Update SP Page Builder Immediately

1. Go to your Joomla administrator panel and navigate to Extensions → Manage → Update.
2. Click "Purge Cache" and then "Find Updates".
3. Locate the update for SP Page Builder (com_sppagebuilder) in the list.
4. Update to version 6.7.1 or higher.

Step 2: Check for Signs of Compromise

Installing the patch does not remove signs of compromise left before the update. Since the SQL injection allowed reading the database and the open relay allowed sending emails, a thorough inspection is necessary:

1. Change all passwords: Database password, FTP/SSH, hosting control panel, as well as passwords for all users with administrator privileges.
2. Check user accounts: In the Users → Manage section, sort the list by registration date. Find and delete any suspicious administrator accounts that you did not create.
3. Check files and folders: Look for suspicious files in the site root, in the /images and /media folders, as well as recently modified files.
4. Check server logs: Review access logs for suspicious requests to the SP Page Builder component.

Step 3: Additional Security Measures

In addition to updating the component, we strongly recommend:

• Update the Joomla core to the latest version.
• Install and configure Admin Tools Pro: Generate a strict .htaccess file, activate SQL injection and CSRF protection.
• Regularly create backups of your site.

Submit a request List of services