PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-65876 joomshaper.com CVE debrief

CVE-2026-65876 is a critical vulnerability in the Joomla Extension SP Page Builder, specifically affecting versions prior to 6.7.1. The vulnerability allows for unauthenticated SQL injection due to improper validation of catid parameters in the loadMoreArticles endpoint. This issue has been assigned a CVSS score of 9.2, indicating a critical severity level.

Vendor
joomshaper.com
Product
SP Page Builder extension for Joomla
CVSS
CRITICAL 9.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-27
Original CVE updated
2026-07-27
Advisory published
2026-07-27
Advisory updated
2026-07-27

Who should care

Administrators and users of Joomla installations with the SP Page Builder extension, especially those using versions prior to 6.7.1, should prioritize patching this vulnerability to prevent potential SQL injection attacks.

Technical summary

The vulnerability exists in the loadMoreArticles endpoint of SP Page Builder, where the catid parameter is not properly validated, leading to an SQL injection vector. This allows attackers to inject malicious SQL code, potentially leading to data breaches or system compromise. The issue is exacerbated by its unauthenticated nature, making it easily exploitable.

Defensive priority

High priority should be given to patching this vulnerability, as the CVSS score of 9.2 indicates a critical severity level. Immediate action is recommended to prevent potential attacks.

Recommended defensive actions

  • Apply the patch or update to SP Page Builder version 6.7.1 or later.
  • Review and restrict access to the loadMoreArticles endpoint if possible.
  • Monitor for suspicious SQL injection attempts.
  • Perform a thorough inventory check of Joomla installations with the SP Page Builder extension.

Evidence notes

The CVE record was published on 2026-07-27T14:17:00.680Z and last modified on 2026-07-27T21:17:16.230Z. The NVD entry is currently Deferred. Limited details are available about the specific exploits or attacks related to this vulnerability.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-27T14:17:00.680Z and has not been modified since then. The NVD entry is currently Deferred.