CVE-2026-65766 in SP Page Builder Extension
Summary
by MITRE • 07/27/2026
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability resides within the Joomla extension developed by joomshaper.com known as SP Page Builder which is susceptible to unauthenticated sql injection attacks affecting versions prior to 6.7.1. This security flaw specifically targets the Dynamic Content endpoint where improper validation of order parameters creates an exploitable condition that allows attackers to manipulate database queries through crafted input. The vulnerability stems from inadequate sanitization and validation of user-supplied order parameters that are directly incorporated into sql query construction without proper escaping or parameterization mechanisms.
The technical exploitation occurs when an attacker sends maliciously crafted requests to the Dynamic Content endpoint with manipulated order parameters that bypass input validation checks. These parameters are then processed within the backend sql queries without proper sanitization, enabling attackers to inject arbitrary sql commands that can be executed against the underlying database. This type of vulnerability falls under the common weakness enumeration category CWE-89 which specifically addresses sql injection flaws where untrusted data is incorporated into sql commands without proper validation or escaping. The attack vector allows for unauthorized data access, modification, or deletion operations that can compromise the entire database infrastructure.
Operationally this vulnerability presents significant risk to Joomla websites using affected SP Page Builder versions as it enables remote code execution and complete database compromise without requiring authentication credentials. Attackers can leverage this weakness to extract sensitive information including user credentials, personal data, and system configuration details. The impact extends beyond immediate data theft as the compromised systems may serve as entry points for further lateral movement within network infrastructure. According to the mitre att&ck framework, this vulnerability maps to technique T1190 - exploit public-facing application which represents a critical attack surface that threat actors frequently target in reconnaissance and initial access phases.
Mitigation strategies should prioritize immediate upgrade to SP Page Builder version 6.7.1 or later where proper input validation and parameterization mechanisms have been implemented to prevent sql injection attacks. Organizations should also implement web application firewalls with sql injection detection capabilities and conduct comprehensive security assessments of all installed extensions. Additional protective measures include disabling unnecessary endpoints, implementing strict input validation at multiple layers, and establishing monitoring protocols to detect anomalous database access patterns. Regular vulnerability scanning and penetration testing should be conducted to identify similar weaknesses in other components of the web application stack that may present comparable attack vectors requiring similar remediation approaches.