JoomShaper SP Page Builder

CVE-2026-65766 and CVE-2026-65879, SP Page Builder for Joomla: a CSRF token Joomla hands to anonymous visitors is the only guard on an ORDER BY injection, plus a shipped-in-source shared secret that opens a mail relay

This is a recovery published by the 2026-08-02 weekly quality audit: the disclosure landed inside the audit window and no entry covered it.

The reason CVE-2026-65766 matters is the shape of the control that was supposed to stop it. Two scores are in circulation and the discloser says which one to use: "The CNA scored the pre-authentication SQL injection 9.2 Critical. We scored it 8.7 High", and "Where the two differ, the CNA’s number is the one that travels with the CVE." (mySites.guru, 2026-07-27), so this entry carries the CNA figures. The Dynamic Content endpoint's tag-sort feature concatenates the request's sort direction value directly into the query's ORDER BY clause (a position no prepared statement can parameterise) and the only thing in front of that endpoint is a Joomla CSRF token. Joomla issues a valid token to every visitor on page load, anonymous ones included, so an attacker's script fetches a page, lifts the token and replays it; mySites.guru states the flaw is "protected only by a CSRF token, which Joomla hands to every anonymous visitor, so it is effectively pre-auth. An attacker could read the entire database, password hashes included" (mySites.guru, 2026-07-27). The discloser confirmed it with a time-based blind proof on its own test install. A CSRF token is an anti-forgery control, not an authentication control, and any extension that treats one as an authorisation gate has the same defect class regardless of vendor.

The second flaw, CVE-2026-65879, is a design decision rather than an oversight. The ajax_contact and form_builder contact-form addons protect the configured recipient address with a signature, but as the discloser puts it, "The contact-form addons protected the recipient address with a secret that was hardcoded identically into every copy of the extension", so the secret is public to anyone who downloads the extension, the signature is forgeable, and an attacker sets an arbitrary recipient and a spoofed sender. The outbound mail then leaves the victim's own domain and mail server, which is what makes this a deliverability and reputation problem rather than a nuisance: the spam or phishing carries the site's authenticated sending identity. Two further issues need only a low-privilege author account, an unescaped SQL injection in the media manager's search and date filters (CVE-2026-65877, CVSS 4.0 8.2), and a media-delete action that removes a request-supplied path with no traversal guard (CVE-2026-65878, CVSS 4.0 8.3), letting an author delete configuration.php or a protective .htaccess. A fifth identifier against the same versions, CVE-2026-65876, is a second unauthenticated SQL injection (through the catid parameter of the loadMoreArticles endpoint, scored CVSS 4.0 9.2 by the CNA) which the discloser explicitly did not report and did not test, but which 6.7.1 also fixes: "If you are working out what 6.7.1 actually fixed, the answer is five issues, not four."

Two things put this above the routine extension-update cycle for a public-sector estate running Joomla. First, the mechanics: an anonymous, scriptable request that returns the full user table needs no exploitation signal to force a timeline. Second, the base rate for this specific extension, mySites.guru notes it reported "the June 2026 unauthenticated icon-upload zero-day that was being exploited in the wild and fixed in 6.6.2" in the same product, and describes SP Page Builder as "one of the most widely installed page builders in the ecosystem". A product whose last unauthenticated flaw was exploited before the fix shipped does not get the benefit of the doubt on the next one.

Triage: the SQL injection produces web-server access-log entries that look entirely legitimate, a valid CSRF token, an ordinary Dynamic Content endpoint path, HTTP 200. The discriminators are in the parameter and the pattern rather than the endpoint: sort-direction values that are not asc or desc, unusually long or syntactically complex query-string values on that endpoint, and above all a long run of near-identical requests from one source with response-time variation rather than response-content variation, which is the signature of a time-based blind extraction. A single request is unremarkable; a few thousand of them against one endpoint from one address, each differing by a character, is the finding. For the mail-relay flaw, the artefact is in the mail logs rather than the web logs: messages leaving the site's mail server whose recipient domain has no relationship to the site's own audience.