External risk intelligence

SP Page Builder Unauthenticated Mail Relay via Hardcoded Secret

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-65879

The vulnerability affects a Joomla extension used to build web pages and manage site forms. Such extensions are typically installed on public-facing websites, making the mail relay functionality and associated forms directly reachable over the internet in common deployment patterns.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in a popular Joomla extension allows unauthenticated attackers to relay emails through your website by exploiting a hardcoded secret. This could enable the forging of email sender addresses for forms processed by the extension, potentially impacting communications and trust. The main concern is confirming relevance and exposure of this extension within your environment.

Forged emails can be sent through websites.
Protects against email spoofing and impersonation.
Confirm if this website tool is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to a Joomla website using the affected SP Page Builder extension. Because no authentication is required and a hardcoded secret is used, an attacker can relay emails through the website, forging the sender's address for any forms processed by the extension. This could lead to the dissemination of malicious content or phishing attempts.

Unauthenticated network access required.
Submit a form with a forged sender.
Relay emails and conduct phishing.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to relay mail through affected systems by exploiting a hardcoded secret. When supported by the advisory, this could impact the integrity of email communications originating from forms managed by the affected extension, potentially leading to abuse or impersonation of legitimate mail senders.

Form mail sender address.
Unauthenticated mail relay via hardcoded secret.
Abuse of sender identity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability in SP Page Builder's mail relay function is likely to impact website owners and administrators who manage Joomla sites. The first practical step is to identify all instances of SP Page Builder, determine their exposure to the internet, and confirm ownership to prioritize remediation efforts.

Ownership: Website administrators and application owners.
Verification: Confirm SP Page Builder installation and exposure.
Action: Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SP Page Builder?

SP Page Builder is a popular extension for the Joomla content management system. It provides a drag-and-drop interface for users to design complex web pages and manage interactive site forms without needing deep coding knowledge. Because it integrates directly into the Joomla backend and handles form submissions, it is a common tool for site owners who need to capture user input or contact requests on their web pages.

What does CVE-2026-65879 mean?

This vulnerability is classified as CWE-798, which refers to the use of a hardcoded credential. In this case, SP Page Builder uses a single, product-wide secret that is embedded within the software. Because this secret is fixed and shared across all installations, an attacker can use it to bypass security checks and interact with the extension's mail relay functionality, even if they do not have valid administrative credentials for the website.

How does an attacker trigger this bug?

An attacker exploits this by sending specifically crafted network requests to the target Joomla site. Because the vulnerability allows unauthenticated access, the attacker does not need an existing account or session. It is important to note that this bug specifically relates to the mail relay function; simply visiting the public-facing side of a page or viewing forms will not trigger the vulnerability without the malicious request payload designed to abuse the hardcoded secret.

Is my website at risk from this CVE?

According to Halo Surface Signal, this vulnerability is considered highly relevant for public-facing websites. Since SP Page Builder is typically used to enable contact forms on the internet, the mail relay functionality is often reachable from outside your network. If your site runs an affected version of this extension and is accessible to the public, an attacker could potentially use your site to send forged emails.

How should I respond to this vulnerability?

First, conduct an audit of your Joomla environment to confirm if SP Page Builder is installed and determine which specific version you are running. If you find the affected version, prioritize confirming your site's internet exposure. You should then coordinate with your technical team to plan an update for the extension during your next scheduled maintenance window to replace the vulnerable code and secure your form communications.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.