Unauthenticated Local File Inclusion in SP Page Builder by JoomShaper
CVE-2026-67285

9.2CRITICAL

Key Information:

Vendor

Joomshaper.com

Status
Sp Page Builder Extension For Joomla
Vendor
CVE Published:
12 August 2026

What is CVE-2026-67285?

An unauthenticated vulnerability exists in the SP Page Builder by JoomShaper, allowing attackers to include arbitrary PHP files from local paths. This issue affects versions prior to 6.8.0 and could potentially lead to unauthorized access and exploitation of the system. Users are advised to update to the latest version to mitigate the risks associated with this vulnerability.

Affected Version(s)

SP Page Builder extension for Joomla 1.0.0-6.7.1

References

https://www.joomshaper.com/page-builder
product

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor, mysites.guru
.