CVE-2026-65876: SP Page Builder SQL Injection Vulnerability

CVE-2026-65876 is an unauthenticated SQL injection vulnerability in SP Page Builder for Joomla affecting versions before 6.7.1. Improper validation allows attackers to exploit the catid parameter. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-65876 Overview

CVE-2026-65876 is an unauthenticated SQL injection vulnerability in the JoomShaper SP Page Builder extension for Joomla. The flaw affects versions prior to 6.7.1 and stems from improper validation of the catid parameter in the loadMoreArticles endpoint. Remote attackers can inject arbitrary SQL statements without authentication, exposing database contents to unauthorized retrieval. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the Joomla database through the loadMoreArticles endpoint, resulting in disclosure of sensitive data including user credentials and session information.

Affected Products

JoomShaper SP Page Builder for Joomla, versions prior to 6.7.1
Joomla sites using the SP Page Builder extension with public article rendering
Any deployment exposing the loadMoreArticles endpoint to the network

Discovery Timeline

2026-07-27 - CVE-2026-65876 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-65876

Vulnerability Analysis

The vulnerability resides in the loadMoreArticles endpoint exposed by SP Page Builder. This endpoint accepts a catid parameter used to filter articles by category identifier. The extension fails to sanitize or parameterize this input before incorporating it into a SQL query executed against the Joomla database.

An unauthenticated attacker can supply a crafted catid value containing SQL syntax. The database engine then executes the injected clauses in the context of the Joomla site user. Successful exploitation permits extraction of arbitrary data from any table accessible to the Joomla database account.

The EPSS probability is 0.228% with a percentile of 13.677 as of 2026-07-30, reflecting current predictive exploitation likelihood rather than existing in-the-wild activity.

Root Cause

The root cause is missing input validation and unsafe SQL query construction. The catid parameter reaches the query builder without type casting to an integer or use of parameterized statements. Concatenating untrusted input into a SQL string breaks the boundary between code and data, enabling injection.

Attack Vector

Exploitation requires only network access to the affected Joomla site. The attacker sends an HTTP request to the loadMoreArticles endpoint with a malicious catid value. No authentication, user interaction, or elevated privileges are needed. Attackers can automate discovery by fingerprinting Joomla sites running SP Page Builder and probing the vulnerable endpoint.

No verified proof-of-concept code has been published. See the JoomShaper Page Builder Overview for product context.

Detection Methods for CVE-2026-65876

Indicators of Compromise

HTTP requests to the loadMoreArticles endpoint containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the catid parameter
Non-numeric or unusually long values submitted to the catid parameter
Database error messages returned to clients referencing SQL syntax faults
Unexpected spikes in outbound response sizes from Joomla endpoints associated with article loading

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag SQL metacharacters in the catid query parameter
Inspect Joomla access logs for repeated requests to loadMoreArticles from single source IPs
Correlate database slow-query logs with HTTP request timestamps to identify time-based blind injection attempts
Alert on responses containing MySQL error strings served from Joomla routes

Monitoring Recommendations

Enable verbose logging on the web server and forward logs to a centralized SIEM for retention and query
Monitor Joomla database accounts for unusual query patterns targeting users, sessions, or credential tables
Track the version of installed Joomla extensions across the estate and alert on outdated SP Page Builder deployments

How to Mitigate CVE-2026-65876

Immediate Actions Required

Upgrade SP Page Builder to version 6.7.1 or later on all Joomla installations
Audit web server access logs for prior exploitation attempts against the loadMoreArticles endpoint
Rotate Joomla administrator credentials and database user passwords if compromise is suspected
Review Joomla user tables and session stores for unauthorized additions or modifications

Patch Information

JoomShaper addresses the vulnerability in SP Page Builder 6.7.1. Administrators should download the update from the JoomShaper Page Builder Overview and apply it through the Joomla extension manager. Verify the installed version after upgrade using the Joomla administrator console.

Workarounds

Block requests to the loadMoreArticles endpoint at the WAF or reverse proxy until the patch is applied
Enforce integer type validation on the catid parameter using WAF rewrite rules
Restrict database privileges of the Joomla database user to the minimum required tables
Disable the SP Page Builder extension temporarily if the site does not rely on its rendering features

bash

# Example WAF rule (ModSecurity) blocking non-numeric catid values
SecRule ARGS:catid "!@rx ^[0-9]+$" \
    "id:1026065876,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2026-65876: Non-numeric catid parameter blocked'"