CVE-2026-78375: SP Page Builder SQL Injection Vulnerability

CVE-2026-78375 Overview

CVE-2026-78375 is an authenticated SQL injection vulnerability in the JoomShaper SP Page Builder extension for Joomla, affecting both Free and Pro editions from version 5.2.1 through 6.9.0. The flaw resides in the content plugin's plgContentSppagebuilder::onContentAfterSave() handler, which concatenates user-supplied input into a SQL WHERE clause without sanitization or type casting. Authenticated users with content-save privileges can trigger the vulnerable code path on any component that fires onContentAfterSave. The issue is classified under [CWE-89] and enables time-based blind SQL injection against the Joomla database.

Critical Impact
Attackers with privileged access can extract arbitrary database contents, including credentials from #__users and active tokens from #__session.

Affected Products

JoomShaper SP Page Builder Free 5.2.1 through 6.9.0
JoomShaper SP Page Builder Pro 5.2.1 through 6.9.0
Joomla installations with the SP Page Builder content plugin enabled

Discovery Timeline

2026-09-14 - CVE-2026-78375 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-78375

Vulnerability Analysis

The vulnerability lives in the plgContentSppagebuilder::onContentAfterSave() method of the SP Page Builder content plugin. The handler reads jform[attribs][sppagebuilder_article_id] directly from the HTTP request. It then concatenates that value into a query targeting #__sppagebuilder with the clause WHERE view_id = .... No quoting, escaping, or integer casting is applied before the value reaches the database driver.

An additional design flaw compounds the injection point. The vulnerable block executes before the com_content.article context check. As a result, the query runs on every onContentAfterSave event regardless of which Joomla component triggered the save operation. This broadens the attack surface across any extension that persists content.

Root Cause

The underlying weakness is unsafe concatenation of request data into SQL, combined with reliance on Joomla's ARRAY input filter for sanitization. InputFilter::clean() returns (array) $source with element values untouched. Attackers can therefore deliver a full SQL payload inside a single POST parameter structured as an array, bypassing Joomla's default filtering assumption.

Attack Vector

Exploitation requires an authenticated Joomla account with permission to save content. The attacker submits a crafted POST request containing a SQL payload in the jform[attribs][sppagebuilder_article_id] array field. Because the payload is delivered inside an array, the input filter passes it through unchanged. The resulting query performs time-based blind SQL injection, allowing byte-by-byte extraction of sensitive tables such as #__users (password hashes) and #__session (active session tokens). Successful extraction of session tokens can lead to administrator account takeover.

No verified proof-of-concept code is published for this issue. See the JoomShaper SP Page Builder Pro product page for vendor information.

Detection Methods for CVE-2026-78375

Indicators of Compromise

POST requests to Joomla content-save endpoints containing jform[attribs][sppagebuilder_article_id] with non-numeric values, SQL keywords, or time-delay functions such as SLEEP() or BENCHMARK().
Unusually long response times on index.php requests that save content, indicating time-based blind injection.
Unexpected read queries against #__users or #__session originating from the Joomla application user.
Session records in #__session tied to administrator accounts from unfamiliar IP addresses shortly after suspicious content-save activity.

Detection Strategies

Inspect web server access logs for POST requests carrying array-formatted jform[attribs] parameters that include SQL syntax.
Enable MySQL/MariaDB general query logging or slow query logging to surface anomalous WHERE view_id = ... clauses containing SQL operators.
Deploy a Web Application Firewall (WAF) rule that inspects nested array parameters for SQL metacharacters and sleep-based payloads.

Monitoring Recommendations

Alert on repeated content-save requests from a single authenticated session that produce response times exceeding a defined baseline.
Correlate authentication events with subsequent privileged content-save activity to detect account misuse.
Monitor for privilege changes to Joomla user accounts and creation of new Super User accounts following content-save spikes.

How to Mitigate CVE-2026-78375

Immediate Actions Required

Upgrade SP Page Builder (Free and Pro) to a fixed release above 6.9.0 as published by JoomShaper.
Restrict content-save permissions to trusted user groups until patching is complete.
Rotate credentials and invalidate all active Joomla sessions if exploitation is suspected.
Audit the #__users table for unauthorized administrator accounts or modified password hashes.

Patch Information

Refer to the vendor's JoomShaper SP Page Builder Pro product page for the corrected release and changelog. Apply the update through the Joomla Extension Manager and verify the installed version reports a build later than 6.9.0.

Workarounds

Disable the SP Page Builder content plugin in the Joomla Plugin Manager if immediate patching is not feasible.
Deploy WAF rules that block array-formatted jform[attribs][sppagebuilder_article_id] values containing non-numeric characters.
Reduce the number of accounts holding content-edit or content-save privileges to the minimum required.
Enforce multi-factor authentication on all Joomla back-end accounts to raise the bar for account compromise.

bash

# Example WAF rule (ModSecurity) to block non-numeric values in the vulnerable parameter
SecRule ARGS:'jform[attribs][sppagebuilder_article_id]' "!@rx ^[0-9]+$" \
    "id:1026078375,phase:2,deny,status:403,\
     msg:'CVE-2026-78375 SP Page Builder SQLi attempt',\
     tag:'attack-sqli'"