CVE-2026-67287 Overview
CVE-2026-67287 is an access control vulnerability in the SP Page Builder Joomla extension developed by JoomShaper. The flaw affects all versions of SP Page Builder prior to 6.8.0. Unauthenticated attackers can create comments on affected sites even when guest commenting is disabled. The vulnerability exists because the application accepts user-supplied input that overrides the server-side setting controlling guest commenting. This weakness is classified as an Improper Access Control issue [CWE-284] and carries a CVSS 4.0 score of 6.3.
Critical Impact
Remote, unauthenticated attackers can post comments on Joomla sites running SP Page Builder even when administrators have disabled guest commenting, enabling spam, phishing content, and reputation damage.
Affected Products
- JoomShaper SP Page Builder versions prior to 6.8.0
- Joomla installations using the SP Page Builder extension
- Sites with guest commenting explicitly disabled in SP Page Builder configuration
Discovery Timeline
- 2026-08-12 - CVE-2026-67287 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-67287
Vulnerability Analysis
The vulnerability resides in the comment creation workflow of SP Page Builder, a page-building extension for the Joomla content management system. Administrators can toggle guest commenting to prevent unauthenticated users from submitting comments. The affected code path fails to enforce this configuration on the server side. Instead, the setting can be overridden by attacker-controlled input in the comment submission request.
As a result, an unauthenticated attacker can submit a crafted request that instructs the application to treat guest commenting as enabled, regardless of the site's actual configuration. The impact is limited to integrity of user-generated content and does not directly compromise confidentiality or availability of the underlying system.
Root Cause
The root cause is improper access control [CWE-284]. The extension trusts a client-supplied parameter that should be enforced exclusively from server-side configuration. This design flaw allows the client to dictate an authorization decision, bypassing the intended administrative control over guest commenting.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the SP Page Builder comment endpoint with additional parameters that override the guest-commenting flag. The server processes the request and stores the comment as if guest commenting were permitted. Exploitation can be automated to enable large-scale comment spam, injection of phishing links, or content manipulation.
For technical details, refer to the JoomShaper Page Builder Resource.
Detection Methods for CVE-2026-67287
Indicators of Compromise
- Comments appearing on the site attributed to guest or anonymous users while guest commenting is administratively disabled.
- Comment submissions containing unexpected parameters that mirror server-side configuration flag names.
- High volumes of comment POST requests originating from single IP addresses or automated user agents.
Detection Strategies
- Review web server access logs for POST requests to SP Page Builder comment endpoints containing configuration-override parameters.
- Query the Joomla database for recently created comment records lacking associated authenticated user identifiers.
- Correlate spikes in comment creation with the absence of prior authentication events in application logs.
Monitoring Recommendations
- Enable verbose logging on the Joomla application and web server for all requests to SP Page Builder endpoints.
- Alert on anomalous comment creation rates or comments containing URLs, scripts, or obfuscated payloads.
- Monitor the SP Page Builder extension version across Joomla deployments to identify systems still running vulnerable releases.
How to Mitigate CVE-2026-67287
Immediate Actions Required
- Upgrade SP Page Builder to version 6.8.0 or later on every Joomla instance where the extension is installed.
- Audit existing comments for spam, phishing links, or malicious content created since the extension was deployed.
- Restrict access to the comment submission endpoint using a web application firewall until patching is complete.
Patch Information
JoomShaper addressed the vulnerability in SP Page Builder version 6.8.0. Administrators should download the updated release from the vendor and apply it through the Joomla extension manager. Verify the installed version after the update to confirm remediation. Refer to the JoomShaper Page Builder Resource for release information.
Workarounds
- Disable the SP Page Builder comment functionality entirely until the patched version is deployed.
- Deploy WAF rules that strip or reject request parameters attempting to override guest-commenting configuration flags.
- Require CAPTCHA or moderation queues on all comment submissions to reduce the operational impact of unauthorized posts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
