EUVD-2026-49198
GHSA-w26p-j3v2-w753
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRecover hardcoded secret from extension source
-
DeliveryLocate target running SP Page Builder < 6.7.1
-
ExploitCraft form request with forged mail-from
-
ExecutionSubmit to public form endpoint
-
PersistServer relays spoofed email
-
ImpactDeliver phishing/spam at scale
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the target Joomla site runs the SP Page Builder extension at a version between 1.0.0 and 6.7.0 with a reachable SP Page Builder form/mail submission feature exposed to anonymous users (its normal, default deployment for public contact/landing-page forms). The attacker must possess the hardcoded product-wide secret, which is recoverable from the extension's distributed code, so it is not a meaningful barrier. No authentication and no user interaction are needed (PR:N/UI:N); the main limiting factor is that impact is confined to forging the outbound mail sender address (mail relay/spoofing) rather than direct code execution or data theft, and the site must actually have SP Page Builder form functionality enabled. |
| Impact | The published CVSS 3.1 score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, but that C:H/I:H/A:H impact profile is inconsistent with the described effect - forging the mail-from address of forms is primarily an integrity/spoofing issue (mail relay), not full compromise of confidentiality and availability; this over-scored impact should be verified against the vendor advisory. Corroborating signals point to lower real-world risk: EPSS is only 0.14% (4th percentile), SSVC exploitation is 'none', KEV does not list it, and no POC is referenced. However, SSVC marks it Automatable:yes with Technical Impact:total, and the unauthenticated network vector (AV:N/PR:N) plus a single product-wide secret means abuse can be scripted at scale once the secret is public. Net: a real, easily-automatable spam/phishing-relay problem worth prompt patching, but the 9.8 'critical' rating likely overstates true impact - treat the practical severity as moderate-to-high (mail abuse), not full RCE-class. |
| Exploit ScenarioDerived | An attacker extracts the product-wide hardcoded secret from the freely available SP Page Builder source, then sends crafted, unauthenticated HTTP form-submission requests to a target Joomla site running a version below 6.7.1, setting an arbitrary mail-from address. The server relays convincing emails that appear to originate from the trusted domain, which the attacker uses for phishing or spam at scale; no POC is publicly referenced, but the network vector and low complexity (AV:N/AC:L) make it straightforward to automate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in all versions before 6.7.1, where a hardcoded, product-wide secret lets unauthenticated remote attackers forge the 'mail from' address of form submissions. Because the same secret ships across every deployment of the extension, any attacker who knows it can drive the server to send spoofed emails, enabling phishing and spam relayed through the trusted Joomla host. No public exploit code has been identified at time of analysis, EPSS risk is low (0.14%, 4th percentile), and CISA SSVC lists exploitation status as none.
RemediationAI
Primary fix: upgrade the SP Page Builder extension to version 6.7.1 or later (Vendor-released patch: 6.7.1), which addresses the hardcoded-secret mail forgery; obtain it via the vendor at https://www.joomshaper.com/page-builder and review the disclosure at https://mysites.guru/blog/sp-page-builder-sql-injection-mail-relay-disclosure/. If immediate patching is not possible, restrict or disable the SP Page Builder form/mail submission endpoints (contact and form components) so they cannot be reached by anonymous users - this stops the relay abuse but breaks legitimate site forms until patched. As additional compensating controls, enforce SPF/DKIM/DMARC on the sending domain and monitor outbound mail from the Joomla host for spoofed From addresses or spikes in form-triggered mail, and place the site behind a WAF rule that inspects form submissions to the SP Page Builder handler; these reduce phishing effectiveness and give detection but do not remove the underlying forgeable secret.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SP Page Builder is a drag-and-drop page/content builder extension for the Joomla CMS, widely used to build landing pages and contact/form components. The root cause is CWE-798 (Use of Hard-coded Credentials): a secret used to validate or sign form/mail parameters is embedded identically in the product across all installations rather than being generated per-site. Because it is not unique per deployment, the secret provides no real trust boundary - anyone with a copy of the extension source (freely inspectable) recovers it and can then craft requests that the mail-handling logic treats as legitimate, in this case controlling the From address of outbound form mail. CPE cpe:2.3:a:joomshaper.com:sp_page_builder_extension_for_joomla identifies the exact affected component.
Know when Sp Page Builder Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote (AV:N/AC:L/PR:N/UI:N) but impact is limited to forging outbound mail sender addresses, so integrity-low only with no confidentiality or availability effect.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
3DescriptionCVE.org
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.
Executive ViewAI
The SP Page Builder extension for Joomla contains a hardcoded authentication secret shared across all deployments, enabling unauthenticated attackers to forge email sender addresses and relay spam through your organization's trusted email infrastructure. This exposes your domain to sender reputation damage, delivery failures, and phishing impersonation attacks.
No vendor-released patch identified at time of analysis. Interim mitigations: disable SP Page Builder extension if not business-critical; enforce SPF, DKIM, and DMARC with strict authentication policies on sending domains; enable comprehensive logging of all form-based email submissions with sender validation; configure email gateway rate limiting and anomalous sender-address detection; restrict SMTP access from affected Joomla servers to authenticated relay only; monitor mail server logs for spoofed sender patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote unauthenticated arbitrary file upload in JoomShaper SP Page Builder extension for Joomla (versions 1.0.0 through
Unauthenticated local PHP file inclusion in the SP Page Builder extension for Joomla (versions before 6.8.0) lets remote
Unauthenticated SQL injection in SP Page Builder for Joomla prior to version 6.7.1 allows remote attackers to extract se
Unauthenticated SQL injection in the SP Page Builder Joomla extension before version 6.7.1 allows remote attackers to ex
Authenticated arbitrary file deletion in SP Page Builder before 6.7.1 allows attackers with administrative access to Joo
SQL injection in the SP Page Builder extension for Joomla versions prior to 6.7.1 allows an authenticated attacker with
Unauthenticated path traversal in SP Page Builder (Joomla extension by joomshaper.com) versions prior to 6.8.0 permits r
Unauthenticated comment creation in SP Page Builder for Joomla (versions prior to 6.8.0) allows remote attackers to bypa
Exploit-DB