External risk intelligence

Joomla SP Page Builder Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-65766

The vulnerability affects a Joomla extension used to build website content. Extensions for web content management systems are typically integrated into the public-facing web interface of a site, making them reachable to any user or visitor accessing the website over the internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability in a popular website content builder extension for Joomla. The flaw allows unauthenticated attackers to inject malicious SQL code into the system by exploiting improper validation of order parameters. This could potentially lead to unauthorized access, modification, or deletion of sensitive data stored in the website's database.

Unauthenticated attackers can exploit a web content builder flaw.
Matters because it can expose website data to unauthorized access.
Confirm relevance and any potential exposure to your Joomla sites.

Attack Path

How an attacker could exploit the issue

An attacker can target a Joomla website by sending specially crafted requests to the SP Page Builder's Dynamic Content endpoint. This endpoint, which is exposed to the internet without requiring any authentication, improperly validates order parameters. By manipulating these parameters, an attacker can inject malicious SQL code, potentially leading to unauthorized access and modification of sensitive data.

No authentication required to access.
Unsanitized order parameters in Dynamic Content.
Risk of unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL code into a website's database when specific order parameters are not properly validated. This could potentially lead to unauthorized access to or modification of sensitive website data.

Website database integrity.
Improper validation of order parameters.
Unauthorized database access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in SP Page Builder affects Joomla websites, making the application owner and platform team primary responders. The first step is to inventory all Joomla installations, identify which are running the affected SP Page Builder version, and assess their internet exposure and business criticality to prioritize remediation efforts.

Application owners to confirm usage.
Verify internet-facing exposure.
Plan and coordinate updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SP Page Builder for Joomla?

SP Page Builder is a third-party extension used by Joomla site administrators to design and arrange page layouts. It provides a visual interface for managing website content, which acts as a layer on top of the base Joomla platform. Because it handles page components and dynamic content, it is deeply integrated into the site's front-end experience for visitors.

What is the vulnerability in CVE-2026-65766?

This vulnerability is an SQL injection, classified as CWE-89. It occurs when a software component fails to properly filter or validate input from a user before using it in a database query. In this specific case, the extension does not safely process certain order parameters in its Dynamic Content endpoint, allowing an external user to manipulate the resulting database commands.

How does an attacker trigger this SQL injection?

An attacker triggers this flaw by sending a specially crafted web request to the vulnerable Dynamic Content endpoint of the extension. It is important to note that simply visiting the website or viewing normal pages does not trigger the bug; the attacker must intentionally send a request with manipulated parameters to that specific endpoint. Because it does not require authentication, anyone with network access to the site can attempt the request.

Is my website at risk if it uses SP Page Builder?

According to Halo Surface Signal, this extension is designed to build public-facing content, meaning it is often directly accessible via the internet. If your site runs a version of SP Page Builder earlier than 6.7.1 and is reachable by the public, it is considered internet-facing and highly relevant. You should prioritize checking these installations, as the public nature of the endpoint increases the likelihood of potential reachability.

How do I address this CVE-2026-65766 vulnerability?

Start by auditing your environment to build an inventory of all Joomla installations and determine which are running the affected versions of SP Page Builder. Once you have identified the systems, assess their business criticality and internet exposure to coordinate an update. Applying the vendor-provided patch to move to version 6.7.1 or higher is the primary way to fix the improper validation issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.