PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-65876 joomshaper.com CVE debrief

CVE-2026-65876 is a critical vulnerability in the Joomla Extension SP Page Builder, specifically affecting versions prior to 6.7.1. The vulnerability allows for unauthenticated SQL injection due to improper validation of catid parameters in the loadMoreArticles endpoint. This issue has been assigned a CVSS score of 9.2, indicating a critical severity level.

Vendor
joomshaper.com
Product
SP Page Builder extension for Joomla
CVSS
CRITICAL 9.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-27
Original CVE updated
2026-08-12
Advisory published
2026-07-27
Advisory updated
2026-08-12

Who should care

Administrators and users of Joomla installations with the SP Page Builder extension, especially those using versions prior to 6.7.1, should prioritize patching this vulnerability to prevent potential SQL injection attacks.

Technical summary

The vulnerability exists in the loadMoreArticles endpoint of SP Page Builder, where the catid parameter is not properly validated, leading to an SQL injection vector. This allows attackers to inject malicious SQL code, potentially leading to data breaches or system compromise. The issue is exacerbated by its unauthenticated nature, making it easily exploitable.

Defensive priority

High priority should be given to patching this vulnerability, as the CVSS score of 9.2 indicates a critical severity level. Immediate action is recommended to prevent potential attacks.

Recommended defensive actions

  • Apply the patch or update to SP Page Builder version 6.7.1 or later.
  • Review and restrict access to the loadMoreArticles endpoint if possible.
  • Monitor for suspicious SQL injection attempts.
  • Perform a thorough inventory check of Joomla installations with the SP Page Builder extension.

Evidence notes

The CVE record was published on 2026-07-27T14:17:00.680Z and last modified on 2026-07-27T21:17:16.230Z. The NVD entry is currently Deferred. Limited details are available about the specific exploits or attacks related to this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-65876 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-65876

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-65876 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-65876

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.