SP Page Builder for Joomla Hit by 4 New Flaws (CVE-2026-65766 and More): Data-Leak Risk, Update to 6.7.1

SP Page Builder, a popular page-building tool for Joomla, the free software used to build websites around the world, had four new vulnerabilities (software weaknesses) disclosed in July 2026. Two of them could let attackers pull internal site data without logging in, and are rated 9.2 out of 10 in severity (CVE-2026-65766 and CVE-2026-65876). All are fixed in version 6.7.1, so anyone using it needs to update to that release.

Just recently, in June 2026, SP Page Builder was hit by a severity-10.0 flaw that let attackers take over the whole server without logging in (CVE-2026-48908), which was used in real attacks. That same month, another popular page-building tool, Page Builder CK (CVE-2026-56290), saw the same kind of takeover. This article first explains the latest four July flaws, then covers the June takeover flaws (the first wave). Because the wave targeting Joomla page builders keeps coming, the tools you use need frequent updates.

[July 2026, latest] Four new SP Page Builder vulnerabilities

These four were disclosed on July 27, 2026 through Joomla's official security channel. All are resolved in version 6.7.1, and every release from 1.0.0 through 6.7.0 is affected. First, the overall picture. The severity figures are CVSS 4.0, an international scale that rates a flaw's danger out of 10.

Of the four, the top two (CVE-2026-65766 and CVE-2026-65876) are especially dangerous. Because they work without logging in, they can be targeted by anyone as long as the site is public. The remaining two (CVE-2026-65877 and CVE-2026-65878) require an admin-level login, so their standalone danger is a bit lower, but combined with other holes they become material for widening the damage.

The star of this batch, "SQL injection," is an attack that slips unauthorized commands into the mechanism that sends orders to the database behind the site (the storehouse that keeps member data, articles, and so on). Attackers who automatically scan the internet for sites using SP Page Builder can pull it off simply by sending crafted strings into the inputs that specify sort order or category. Their goal is to drag out the contents of the database that should never be visible. Members' email addresses, clues to their passwords, and unpublished articles or settings could be extracted, and the stolen data is used for unauthorized logins to other services or to scout the next attack.

CVE-2026-65766: the database is peeked at through the sort-order input (no login, 9.2)

In the "dynamic content" feature, the input that specifies the sort order (order) of the data to show was not validated enough. An attacker who is not logged in can slip an unauthorized database command into this input and read internal information. It is classified as SQL injection (CWE-89), with a CVSS 4.0 of 9.2 (Critical). As a no-login route to data leakage, it is the highest priority of the four.

CVE-2026-65876: the load-more feature becomes a way in (no login, 9.2)

In the "loadMoreArticles" feature that loads the rest of an article, the input specifying the category (catid) had the same kind of validation gap. This too works without logging in: sending a crafted category value pulls out the database's contents. It is rated 9.2 (Critical) on CVSS 4.0, the same top tier as CVE-2026-65766. Only the entry point differs; the danger is the same, so both must be closed together.

CVE-2026-65878: files on the server get deleted from the admin screen (login required, 8.3)

In the media manager that handles images and the like, the check on a file's location (path) and the permission check were loose, so even files in places you should not be able to touch could be deleted. It is classified as improper path handling (CWE-22), with a CVSS 4.0 of 8.3 (High). Exploiting it requires an admin-level login, but if it succeeds, important site files can be deleted and the service can stop working.

CVE-2026-65877: the database is peeked at through media search (login required, 8.2)

The media manager's search box and date filter left room for SQL injection. Because exploiting it requires an admin-level login, it is rated 8.2 (High) on CVSS 4.0, lower than the two no-login flaws. Even so, if a privileged user account is hijacked, it becomes a foothold for pulling out internal information.

The fix is the same for all: update SP Page Builder to 6.7.1 or later. You can get it from the official JoomShaper page. With two no-login flaws in the mix, the more public your site, the sooner you should apply it. To map out which extensions your site depends on, the approach of auditing external components also helps. As of this article's publication, these four July flaws are not on the list of actively exploited flaws (CISA KEV), but June's CVE-2026-48908 is already listed, so this product is clearly on attackers' radar.

[June 2026, first wave] Overview of the takeover flaws

The two flaws come from different vendors and different products, but their makeup is nearly identical. In both cases, a file intake that should only be usable by an administrator was left open to anyone without a login. By simply sending a small attack program to that intake, an attacker can freely control the server's contents.

A severity of "10.0" is the perfect score on CVSS (the Common Vulnerability Scoring System), a worldwide standard for rating how serious a flaw is. A 10.0 is rare and only appears when the conditions line up: no login needed, exploitable remotely, and full control of the server. This time, two of them landed in the same period, in tools used for the same purpose.

Who is targeting this, and what do they do?

The attackers are not people with a grudge against anyone in particular. They are operators who automatically scan the entire internet with machines, hunting down every site that uses these two tools. Because no login or password is needed, they do not pick their targets; they hit any site they find, one after another. A personal blog, a small company's website, a city hall or a school page—if the conditions match, all are equally in scope.

What the attacker does is plant a private back door on the server and quietly create a secret account that impersonates an administrator. On sites that were actually attacked, investigators found fake admin accounts dressed up with names familiar to real staff, such as "Web Editor" or "Site Helper." On the surface nothing changes, while only the back end has been taken over.

A hijacked site is not simply left alone. It gets used as a stepping stone to redirect visitors to fake sites, to skim personal data entered into membership records or contact forms, or as a base to attack other sites. The operator loses trust, and visitors are unknowingly placed at the entrance to harm. A similar takeover flaw was found not long ago in a Joomla text-editing tool (JCE's CVE-2026-48907), and a wave of attacks targeting Joomla extensions has continued through this period.

What Joomla and page-building tools are

Joomla is free software that lets you build and update a website without programming knowledge. It is one of the best-known site foundations after WordPress, used for company sites, membership sites, and city or school pages.

Joomla works on its own, but it is common to add "extensions" that bolt on extra features. The two products at issue here, SP Page Builder and Page Builder CK, are especially popular "page-building tools." You drag pieces like text, images, and buttons into place to build a polished page. That ease of use means many sites run them, which widens the blast radius of these flaws.

According to a Censys survey, about 194,793 web properties across roughly 3,080 hosts on the internet were found running SP Page Builder. That is only what is visible from the outside; the real number of installs is likely far higher.

How the SP Page Builder flaw (CVE-2026-48908) works

CVE-2026-48908: broken in through the icon-image intake

The problem was in a feature called "asset.uploadCustomIcon," which receives the icon images SP Page Builder uses on a page. It should only be used by a logged-in administrator, but according to mySites.guru's analysis, this intake had neither a check for whether the requester was logged in nor a check that the file sent was really an image.

As a result, an attacker can, without logging in, place a program (a PHP file) disguised as an image on the server. Because the file is saved in a spot reachable directly from the web, the program runs the moment the attacker visits its address, letting them control the server from outside. This type of flaw, where an outsider gets to run arbitrary programs, is classified as CWE-434 (unrestricted upload of a dangerous file), and it scores an extremely high 10.0 on the latest CVSS standard (4.0) and 9.8 on the older one (3.1).

Proof-of-concept code that reproduces the attack is already public on GitHub, so the attack can be reproduced without much expertise. Hijacked sites were found to have fake admin accounts using a nonexistent email address ending in "@secure.local," plus a back-door program calling itself "PHP File manager" planted in several locations.

How the Page Builder CK flaw (CVE-2026-56290) works

CVE-2026-56290: the save location and name are the attacker's to choose

The other product, Page Builder CK, has the same root cause in its file intake. According to mySites.guru's analysis, the file intake obediently accepted "which folder" and "what name" to save under exactly as the request specified. There was no restriction limiting uploads to images and no block on PHP files. The only barrier, a "password of sorts" (a CSRF token), could be read by anyone who looks at the site's pages.

As a result, an attacker who is not logged in can drop an attack program into any writable location of their choosing and run it in a browser. The flaw is rated CVSS 10.0 (CWE-284, improper access control) in the GitHub advisory as well. Within hours of the fix going public, attacks planting a back-door program named "bhup.php" on real sites were observed.

Page Builder CK has separate fixes depending on the generation of Joomla you run. The latest line is 3.6.0, and back-ported builds 3.1.1 and 3.4.10 were released at the same time for older generations. You need to update to the build that matches your site's Joomla generation.

Update targets by product

How events unfolded

← Swipe to move

How to check whether you were hijacked

Sites that have already been attacked keep their back doors even after updating. If any of this sounds familiar, update and then check that none of the following traces remain.

• In your list of admin accounts, any unfamiliar user whose email address ends in "@secure.local"
• Admin names you do not remember creating, such as "Web Editor," "Site Helper," or "Admin Backup"
• For SP Page Builder, any unfamiliar ".php" files (especially users.php) under the "images" folder or in "/media/com_admin/" and "/media/regularlabs/"
• For Page Builder CK, any suspicious ".php" files such as bhup.php under "/media/com_pagebuilderck/gfonts/"

If you find even one, there is a high chance you have already been breached. mySites.guru's guide recommends that, in addition to deleting the fake accounts and back-door files, you change every secret—your Joomla admin password, database, and FTP/SSH—force all users to log out, and audit the entire site.

What to do right now

First, confirm whether your site is built on Joomla, and whether it uses SP Page Builder or Page Builder CK. In Joomla's admin screen (System → Manage → Extensions), you can check the installed tools and their versions. If they apply, follow the "update targets" table above and update to the latest version without hesitation. Attacks are already running automatically worldwide, and "our little site won't be targeted" no longer holds.

If you outsource your site to an outside firm, ask them today whether the emergency updates for SP Page Builder and Page Builder CK are done. After updating, be sure to check for the traces listed in the previous section. You can also track actively exploited flaws on CISA's warning list, mirrored in our CISA KEV dashboard. As with these two cases, attacks aimed at Joomla extensions have kept coming lately, and regularly checking for updates to the tools you use is your strongest defense.

Closing

The easier a tool makes it to build a good-looking page, the more sites it ends up on—and the wider the damage when a flaw finally surfaces. SP Page Builder and Page Builder CK come from different vendors and are different products, yet they carried the same weakness: files could be placed without a login. It is a case study in how a handy page-building part can itself become the way in.

What to do is simple. If you use them, update now and check for signs of a takeover. Get both done today. Attacks targeting Joomla extensions have come in quick succession over the past few weeks, so building the habit of following update news—so you don't panic when the next flaw of the same kind appears—is, in the end, the best preparation.

References

• ▸ NVD - CVE-2026-65766 (SP Page Builder unauthenticated SQL injection, CVSS 9.2)
• ▸ NVD - CVE-2026-65876 (SP Page Builder unauthenticated SQL injection, CVSS 9.2)
• ▸ NVD - CVE-2026-65877 (SP Page Builder SQL injection, CVSS 8.2)
• ▸ NVD - CVE-2026-65878 (SP Page Builder path traversal, CVSS 8.3)
• ▸ NVD - CVE-2026-48908 Detail (SP Page Builder)
• ▸ NVD - CVE-2026-56290 Detail (Page Builder CK)
• ▸ Censys - CVE-2026-48908 Advisory (exposure survey)
• ▸ mySites.guru - SP Page Builder Zero Day RCE Fixed in 6.6.2
• ▸ mySites.guru - PageBuilder CK RCE (CVE-2026-56290)
• ▸ GitHub Advisory Database - GHSA-gxrr-wfg5-xqqf
• ▸ JoomShaper official site
• ▸ Joomlack - Page Builder CK official page
• ▸ CISA - Known Exploited Vulnerabilities Catalog