CVE-2026-65766: SP Page Builder SQL Injection Vulnerability

CVE-2026-65766 Overview

CVE-2026-65766 is an unauthenticated SQL injection vulnerability in the JoomShaper SP Page Builder extension for Joomla, affecting versions prior to 6.7.1. The flaw resides in the Dynamic Content endpoint, where the extension fails to properly validate order parameters before incorporating them into database queries. Attackers can inject arbitrary SQL over the network without authentication or user interaction. The issue is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents from Joomla sites running vulnerable SP Page Builder versions, and pivot to further compromise of the underlying CMS.

Affected Products

JoomShaper SP Page Builder for Joomla, versions prior to 6.7.1
Joomla sites with the Dynamic Content feature of SP Page Builder enabled
Any hosting environment exposing vulnerable SP Page Builder endpoints to the internet

Discovery Timeline

2026-07-27 - CVE-2026-65766 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-65766

Vulnerability Analysis

SP Page Builder is a widely deployed Joomla page-building extension developed by JoomShaper. The Dynamic Content endpoint accepts client-supplied order parameters used to sort records returned from the database. The extension passes these parameters into SQL statements without adequate validation or parameterization. An attacker can craft the order parameter to alter query structure, append conditional logic, or extract data through techniques such as UNION-based or boolean-based blind injection.

Because the endpoint is reachable without authentication, exploitation requires no valid Joomla account or elevated role. A single unauthenticated HTTP request is sufficient to trigger the flaw. The scope extends beyond the vulnerable component: successful injection can expose Joomla user credentials, session tokens, and configuration secrets stored in the shared database.

Root Cause

The root cause is improper neutralization of input used in an SQL statement [CWE-89]. Order parameters accepted by the Dynamic Content endpoint are concatenated into query fragments rather than bound as parameters or restricted to an allowlist of column names and sort directions. This design flaw allows attacker-controlled strings to modify query semantics.

Attack Vector

Exploitation occurs over the network against the public-facing Joomla site. The attacker issues an HTTP request to the Dynamic Content endpoint with a malicious order value. No credentials, tokens, or user interaction are required. Refer to the MySites Guru SQL Injection Blog for the technical write-up of the injection vector.

No verified public exploit code is referenced in the CVE data. The vulnerability mechanism is described in the linked disclosure.

Detection Methods for CVE-2026-65766

Indicators of Compromise

HTTP requests to SP Page Builder Dynamic Content endpoints containing SQL keywords such as UNION, SELECT, SLEEP, INFORMATION_SCHEMA, or comment sequences in order parameters.
Anomalous database errors logged by Joomla or MySQL/MariaDB shortly after requests to SP Page Builder routes.
Unusual outbound traffic or mail relay activity from the Joomla host following suspicious requests, as described in the public disclosure.

Detection Strategies

Inspect web server access logs for requests to SP Page Builder Dynamic Content routes with encoded SQL syntax in query strings.
Deploy web application firewall (WAF) signatures that flag SQL metacharacters in order or sort parameters.
Correlate spikes in database query errors with HTTP requests to SP Page Builder endpoints.

Monitoring Recommendations

Enable Joomla and database query logging at a level sufficient to capture parameterized inputs.
Alert on unauthenticated access patterns targeting /index.php?option=com_sppagebuilder or related SP Page Builder routes.
Monitor outbound SMTP and HTTP traffic from Joomla hosts for signs of post-exploitation abuse.

How to Mitigate CVE-2026-65766

Immediate Actions Required

Upgrade SP Page Builder to version 6.7.1 or later on all Joomla installations.
Audit web server and database logs for requests matching the injection pattern in the Dynamic Content endpoint.
Rotate Joomla administrator credentials and any database secrets if exploitation is suspected.

Patch Information

JoomShaper has released SP Page Builder 6.7.1, which addresses the improper validation of order parameters in the Dynamic Content endpoint. Administrators should apply the update through the Joomla Extensions Manager or download the latest release from the JoomShaper Page Builder Resource.

Workarounds

Restrict access to SP Page Builder administrative and dynamic content endpoints using web server ACLs or a WAF until patching is complete.
Disable the Dynamic Content feature of SP Page Builder if it is not required for site functionality.
Deploy generic SQL injection filters at the WAF layer to block malicious order and sort parameter values.

bash

# Example WAF rule concept (ModSecurity) - block SQL keywords in SP Page Builder order params
SecRule ARGS_NAMES "@rx (?i)order" \
  "chain,phase:2,deny,status:403,id:1026065766,msg:'Possible CVE-2026-65766 SQLi attempt'"
  SecRule ARGS "@rx (?i)(union|select|sleep\(|information_schema|--|/\*)" "t:none"