CVE-2026-65876 in SP Page Builder Extension
Summary
by MITRE • 07/27/2026
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability exists within the Joomla extension SP Page Builder developed by joomshaper.com, specifically affecting versions prior to 6.7.1. This security flaw represents a critical unauthenticated sql injection vulnerability that can be exploited without requiring any user authentication or privileges. The vulnerability stems from improper validation of the catid parameter within the loadMoreArticles endpoint, which serves as a primary attack vector for malicious actors seeking to manipulate database queries through crafted input parameters.
The technical implementation of this vulnerability occurs when the application processes the catid parameter in the loadMoreArticles endpoint without adequate sanitization or validation measures. This parameter is typically used to filter articles based on category identification within the content management system. When attackers submit maliciously crafted catid values, the application fails to properly escape or validate these inputs before incorporating them into sql queries executed against the backend database. The absence of proper input validation creates a direct pathway for sql injection attacks where attacker-controlled data can be interpreted as sql commands rather than simple parameter values.
The operational impact of this vulnerability extends beyond simple data extraction, as it provides attackers with extensive database access capabilities that could result in complete system compromise. An unauthenticated attacker can leverage this vector to perform various malicious activities including but not limited to data exfiltration, privilege escalation, data manipulation, and potentially remote code execution depending on the underlying database configuration and permissions. The vulnerability affects any Joomla installation running SP Page Builder versions below 6.7.1, making it particularly dangerous given the widespread adoption of this content management system component.
This vulnerability aligns with CWE-89 which specifically addresses sql injection flaws in software applications. The improper input validation directly violates secure coding practices recommended by industry standards and security frameworks. From an attack perspective, this vulnerability maps to multiple ATT&CK techniques including T1190 for exploitation of vulnerabilities and T1071.004 for application layer protocol usage. The lack of authentication requirements makes it particularly attractive to automated attack tools and botnets that scan for common web application vulnerabilities.
Organizations should immediately upgrade to SP Page Builder version 6.7.1 or later to remediate this vulnerability, as no other effective mitigations exist for the underlying code flaw. Additional defensive measures include implementing web application firewalls with sql injection detection capabilities, monitoring database query logs for suspicious activity, and conducting comprehensive security assessments of all installed extensions. The vulnerability demonstrates the critical importance of proper input validation and parameter sanitization in preventing sql injection attacks, particularly in content management systems where multiple components interact with databases through user-provided parameters.