Unauthenticated SQL Injection in SP Page Builder by Joomla Extensions
CVE-2026-65876

9.2CRITICAL

Key Information:

Vendor: Joomshaper.com
Status: Sp Page Builder Extension For Joomla
Vendor: CVE Published:; 27 July 2026

🔔 Create Joomshaper.com Vulnerability Alert

What is CVE-2026-65876?

A vulnerability exists in the SP Page Builder for Joomla that allows unauthenticated attackers to exploit improper validation of 'catid' parameters in the loadMoreArticles endpoint. This security flaw can lead to unauthorized SQL injection attacks, allowing attackers to manipulate database queries and potentially access sensitive data.

Affected Version(s)

SP Page Builder extension for Joomla 1.0.0-6.7.0

References

https://www.joomshaper.com/page-builder

product

CVSS V4

Score:

9.2

Severity:

CRITICAL

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 27, 2026
Vulnerability Reserved
Jul 23, 2026

Credit

Krzysztof Zając, CERT PL

CVE-2026-65876 Data

JSON