External risk intelligence

Joomla SP Page Builder Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-65876

The vulnerability exists in a Joomla extension designed for building web pages, which is intended to be accessed by public web traffic. The affected endpoint is part of a public-facing web component, making it inherently internet-exposed by design in standard deployments.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a popular Joomla extension, specifically related to how it handles article data. This issue allows unauthenticated attackers to inject malicious SQL code into the system, potentially leading to unauthorized access or modification of data. The main concern is confirming if this extension is in use and if it's exposed to the internet.

SQL injection in a Joomla extension.
Confirm if this extension is used and exposed.
Assess relevance and potential data exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a Joomla website that uses the SP Page Builder extension. This would involve targeting the `loadMoreArticles` endpoint, which lacks proper validation of the `catid` parameter. Successfully exploiting this flaw could allow an attacker to inject malicious SQL commands, potentially leading to unauthorized access to or manipulation of the website's database.

No authentication required.
Triggered via `loadMoreArticles` endpoint.
Leads to database compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the integrity of data within the Joomla extension by allowing an unauthenticated attacker to inject malicious SQL commands. This could potentially alter or expose information handled by the extension's article loading feature.

Affected asset: Joomla extension data.
Exposure: Via manipulated article parameters.
Consequence: Data corruption or unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in SP Page Builder likely requires coordination between the application owners responsible for the Joomla site and the infrastructure or platform teams managing the hosting environment. The immediate first step is to identify all instances of the affected component, confirm their exposure to external access, and determine business criticality to prioritize remediation efforts with the appropriate accountable owner.

Application and infrastructure teams own this.
Confirm external reachability and impact.
Plan targeted remediation or vendor updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SP Page Builder for Joomla?

SP Page Builder is a popular extension for the Joomla content management system. Site administrators use it as a visual design tool to create, customize, and arrange page layouts without needing to write code. Because it integrates directly into the website's front end to render content, it often handles dynamic data requests from visitors.

How does CVE-2026-65876 cause SQL injection?

This vulnerability, classified as CWE-89, occurs because the extension fails to properly sanitize user-supplied input. Specifically, the 'loadMoreArticles' feature does not safely handle the 'catid' parameter. An attacker can input malicious SQL commands into this parameter, which the database then processes. This allows unauthorized parties to manipulate or extract data from the underlying database, bypassing standard access controls.

Do I need to be logged in for this to trigger?

No. This vulnerability is unauthenticated, meaning an attacker does not need a user account or administrative privileges to send the malicious request. It is triggered specifically by interacting with the 'loadMoreArticles' endpoint. Simply navigating to standard pages that do not utilize this specific dynamic article-loading feature will not trigger the flaw.

Is my site at risk with CVE-2026-65876?

Halo Surface Signal indicates this vulnerability is very likely relevant to you if you use the affected extension, as it is designed for public web traffic. Because the 'loadMoreArticles' endpoint is a public-facing component of your web infrastructure, it is inherently reachable from the internet. If your site uses an affected version, it is exposed to remote, unauthenticated probes targeting this database interface.

How do I respond to this vulnerability?

The immediate priority is to locate all instances of SP Page Builder within your Joomla environment. Once identified, confirm which instances are accessible to the public internet and verify their current version number. Coordinate with your team to prioritize updates, as upgrading to a patched version is the necessary path to remove the insecure code and prevent unauthorized database access.

References

www.joomshaper.com/page-builder

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.