Table of contents

  1. Understanding the Threat: What Was Fixed?
    1. SQL Injection When Saving Articles and Modules — CVE-2026-78375
    2. CAPTCHA Bypass via Request Parameters — CVE-2026-79700
    3. CAPTCHA Bypass in Joomla Modules — CVE-2026-79701
    4. Renaming Files Outside Allowed Directories — CVE-2026-81564
    5. Uploading Files to Unintended Directories — CVE-2026-81565
    6. Creating and Modifying Menu Items Without the Required Permissions — CVE-2026-81566
  2. Who Is at Risk?
  3. How to Resolve the Problem: Step-by-Step Instructions
    1. Step 1: Update SP Page Builder
    2. Step 2: Check for Possible Signs of Compromise
    3. Step 3: Additional Security Measures
  4. We can do everything for you

On September 14, 2026, JoomShaper released SP Page Builder 6.9.1, addressing a total of six security vulnerabilities. The most serious issue was an SQL injection vulnerability that could allow an authenticated user with permission to save articles or modules to retrieve sensitive data from the Joomla database.

The vulnerabilities have been assigned the identifiers CVE-2026-78375, CVE-2026-79700, CVE-2026-79701, CVE-2026-81564, CVE-2026-81565, and CVE-2026-81566. They affect article and module saving, CAPTCHA-protected forms, the SP Page Builder Media Manager, and menu item creation.

The highest severity rating was assigned to the SQL injection vulnerability CVE-2026-78375 — 8.6 on the CVSS 4.0 scale (High severity). Exploitation requires an authenticated account with the necessary permissions, so this is not an unauthenticated attack. Nevertheless, the vulnerability could allow an attacker to retrieve data from Joomla user and active session tables.

Important:
Update SP Page Builder to version 6.9.1 or later. The vulnerabilities affect both the free and commercial editions of the component, although the two CAPTCHA bypass issues affect SP Page Builder Pro only.

Understanding the Threat: What Was Fixed?

SP Page Builder 6.9.1 addresses six separate security issues. Some of them could allow attackers to read database information, while others made it possible to bypass CAPTCHA, upload or rename files outside the intended directories, and modify menu items without the required permissions.

SQL Injection When Saving Articles and Modules — CVE-2026-78375

This is the most serious vulnerability addressed by this update. It was found in the SP Page Builder content plugin responsible for processing data after a Joomla article is saved.

The value of jform[attribs][sppagebuilder_article_id] was accepted from the request and inserted into an SQL query condition without being explicitly converted to an integer or safely bound as a parameter. The Joomla array filter being used did not sanitize the individual values contained within the array.

In addition, the vulnerable code was executed before the com_content.article context was checked. As a result, it could be triggered not only when saving an article, but also by other onContentAfterSave events, including those involving modules.

An attacker with an account authorized to save a suitable object could perform a time-based blind SQL injection and gradually extract information from the database, including data from Joomla user and active session tables.

Authentication Required
CVE-2026-78375 is not an unauthenticated SQL injection vulnerability. An attacker needs an account with permission to save articles, modules, or another object capable of triggering the vulnerable handler. However, these permissions are often granted to authors and editors, so the risk is not limited to administrators.

The vulnerability affects SP Page Builder Free and Pro versions 5.2.1 through 6.9.0 inclusive.

CAPTCHA Bypass via Request Parameters — CVE-2026-79700

The first CAPTCHA-related vulnerability was discovered in the Opt-in Form addon included with the commercial edition of SP Page Builder.

When processing the form, the server accepted part of the CAPTCHA configuration directly from the request submitted by the visitor. An attacker could modify these parameters and cause the handler to accept the form without successfully completing the configured CAPTCHA challenge.

In SP Page Builder 6.9.1, the server validates these parameters against the addon configuration saved by the administrator and no longer trusts values supplied by the visitor.

The vulnerability affects SP Page Builder Pro versions 5.1.4 through 6.9.0 inclusive.

CAPTCHA Bypass in Joomla Modules — CVE-2026-79701

The second vulnerability affects the Contact Form, Opt-in Form, and Form Builder addons when they are placed inside a Joomla module.

In this context, the CAPTCHA validation result was handled incorrectly, allowing an unauthenticated visitor to submit a form without successfully completing the security challenge. This could be exploited to send large amounts of spam, unwanted enquiries, and fraudulent subscriptions.

Version 6.9.1 ensures that the result returned by the Joomla CAPTCHA plugin is respected regardless of whether the form is published on an SP Page Builder page or inside a module.

This Is Not an Authentication Bypass
Bypassing CAPTCHA does not provide access to the Joomla administrator panel and does not bypass user authentication. It only bypasses the anti-bot protection of the affected form, enabling automated spam and other forms of abuse.

The vulnerability affects SP Page Builder Pro versions 3.2.6 through 6.9.0 inclusive.

Renaming Files Outside Allowed Directories — CVE-2026-81564

The file rename operation in the SP Page Builder Media Manager did not strictly associate a media file ID with its actual path. It also lacked sufficient validation to ensure that the resulting path remained inside an authorized media directory.

A highly privileged user could associate an existing media file ID with a different path and rename an arbitrary file accessible to PHP. For example, renaming configuration.php could disrupt Joomla and make the website unavailable.

Version 6.9.1 introduces validation that associates the database record with the actual file and restricts the operation to permitted directories.

The vulnerability affects SP Page Builder Free and Pro versions 4.0.0 through 6.9.0 inclusive. Exploitation requires a highly privileged account.

Uploading Files to Unintended Directories — CVE-2026-81565

The Media Manager allowed the destination directory to be supplied through a request parameter. This value could completely replace the standard date-based directory and was passed to directory creation and file upload functions without sufficient boundary validation.

A user with author-level permissions could upload an otherwise permitted file into an unintended directory within the Joomla root, such as /administrator, /templates, /cli, or the website root.

However, Joomla filtering prevented the path from escaping the website root, existing files could not be overwritten, and file type restrictions remained in effect. Therefore, this vulnerability should not automatically be described as an unrestricted PHP upload or remote code execution vulnerability.

The vulnerability affects SP Page Builder Free and Pro versions 4.0.0 through 6.9.0 inclusive.

Creating and Modifying Menu Items Without the Required Permissions — CVE-2026-81566

The function used to add an SP Page Builder page to a menu called the com_menus model directly. It checked the SP Page Builder core.edit permission but did not verify whether the user was authorized to create or modify Joomla menu items.

As a result, a user who was allowed to edit SP Page Builder pages but did not have access to the Joomla menu component could create new menu items or overwrite existing ones. Because the home page status was also saved, an attacker could potentially redirect the default menu item to different content.

SP Page Builder 6.9.1 adds the required com_menus permission checks.

The vulnerability affects SP Page Builder Free and Pro versions 4.0.0 through 6.9.0 inclusive.

CVE Numbering Discrepancy
In the JoomShaper changelog, the descriptions of CVE-2026-81565 and CVE-2026-81566 appear to be assigned in reverse order. This article follows the mapping used in the published CVE records: CVE-2026-81565 refers to uploads into unintended directories, while CVE-2026-81566 refers to insufficient authorization checks when working with menu items.

Who Is at Risk?

All website owners running SP Page Builder 6.9.0 or earlier should update immediately. The exact set of vulnerabilities depends on the installed edition and version:

  • SP Page Builder Free and Pro 5.2.1–6.9.0: SQL injection vulnerability CVE-2026-78375.
  • SP Page Builder Pro 5.1.4–6.9.0: CAPTCHA bypass vulnerability CVE-2026-79700.
  • SP Page Builder Pro 3.2.6–6.9.0: CAPTCHA bypass in modules, CVE-2026-79701.
  • SP Page Builder Free and Pro 4.0.0–6.9.0: Media Manager and menu authorization vulnerabilities CVE-2026-81564, CVE-2026-81565, and CVE-2026-81566.

If you are using an older version, updating to 6.9.1 will also include fixes for previous critical SP Page Builder vulnerabilities addressed in versions 6.6.2, 6.7.1, and 6.8.0.

Special Attention for Older Versions
If your website previously ran SP Page Builder 6.6.1 or earlier, you must also take CVE-2026-48908 into account. This was a critical unauthenticated file upload vulnerability that allowed PHP code execution and was exploited in real-world attacks. For websites that remained on older versions for an extended period, updating alone is not sufficient: Joomla files and user accounts must also be thoroughly inspected.

How to Resolve the Problem: Step-by-Step Instructions

Step 1: Update SP Page Builder

  1. Create a complete backup of the website files and database.
  2. In the Joomla administrator panel, go to System → Update → Extensions.
  3. Click “Check for Updates”.
  4. Find SP Page Builder and install version 6.9.1 or later.
  5. After installation, open System → Manage → Extensions and verify that the component, package, and related plugins have all been updated.
  6. Clear the Joomla, SP Page Builder, CDN, and browser caches.
  7. Test the page editor, articles using the SP Page Builder integration, modules, forms, and the Media Manager.

If the Update Is Not Available:
Download the latest package from the official JoomShaper website and install it over the existing version through System → Install → Extensions. If you use SP Page Builder Pro, make sure your subscription and download key are still valid.

Step 2: Check for Possible Signs of Compromise

At the time of publication, there is no confirmed evidence of widespread exploitation of the new vulnerabilities fixed in version 6.9.1. However, installing the update does not reverse changes that may have already been made through a compromised or untrusted user account.

  1. Check users and permissions: Look for unknown accounts and unexpected assignments to the Author, Editor, Manager, and Super User groups.
  2. Terminate unknown sessions: Review active user sessions and terminate any suspicious connections.
  3. Check menu items: Look for new menu items, modified links, changes to the default home page, and items created by users without com_menus permissions.
  4. Check website files: Look for recently created or renamed files in the website root and in the /administrator, /templates, /cli, /images, and /media directories.
  5. Check forms: Review email logs, enquiries, and subscriptions for large amounts of spam, particularly if Contact Form, Opt-in Form, or Form Builder is published inside a module.
  6. Check the logs: Preserve and analyze Joomla, web server, hosting control panel, and security logs before deleting any suspicious objects.

The SQL Injection Could Have Been Used to Read Data
If untrusted authors had access to the website or you discover signs that CVE-2026-78375 may have been exploited, consider the database contents potentially exposed. After cleaning the website, change the passwords of privileged users, terminate all active sessions, regenerate the Joomla secret key, and replace stored API tokens and other sensitive credentials.

Step 3: Additional Security Measures

  • Restrict author and editor permissions: Do not grant access to SP Page Builder, the Media Manager, modules, or menus unless users genuinely require these features.
  • Enable multi-factor authentication for administrators and other privileged accounts.
  • Update Joomla and all other extensions to their latest compatible versions.
  • Remove blocked and unused accounts after preserving any information required for an investigation.
  • Configure CAPTCHA and email restrictions: Test all forms after updating, apply submission rate limits, and monitor outgoing email.
  • Configure a Web Application Firewall: A WAF can reduce the attack surface, but it does not replace updating SP Page Builder.
  • Create regular backups and keep at least one current backup outside the website server.

We can do everything for you

If everything listed above seems too complicated, if you simply do not want to spend your time on it or if you would like to save money on expensive extensions, we are ready to help:

  • update your website to the latest Joomla version together with all extensions used on it;
  • audit the installed extensions and then remove those that are not being used;
  • configure website backups, including backups to remote storage;
  • install licensed versions of popular extensions on your website;
  • protect your website from hacking by implementing additional security measures;
  • take your website under our wing by regularly updating the CMS and all extensions, including commercial ones.

Post Scriptum
Forewarned is forearmed! Attacks and website hacks will undoubtedly continue, but if you implement all the necessary security measures right now, you will reduce the risks to a minimum.

Submit a request List of services

Terms used:

Article, Media Manager, Module, Package, CMS, PHP, SQL, Authentication, Backup, Menu, Redirect, SP Page Builder