What is the CVSS score of CVE-2026-65879?

CVE-2026-65879 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of SP Page Builder are affected by CVE-2026-65879?

The SP Page Builder extension for Joomla contains a hardcoded authentication secret shared across all deployments, enabling unauthenticated attackers to forge email sender addresses and relay spam…

How to fix or mitigate CVE-2026-65879?

Within 24 hours, inventory all Joomla installations to identify those running SP Page Builder versions prior to 6.7.1 and assess the extension's criticality to business email operations. Within 7 days, implement immediate mitigations: disable SP Page Builder if functionality is non-essential, or enforce strict SPF, DKIM, and DMARC authentication on all outbound mail and activate detailed logging of form submission emails for forensic detection of unauthorized sending. Within 30 days, establish a monitoring process for JoomShaper vendor advisories, plan migration to patched version 6.7.1 when released, and conduct log analysis to identify any unauthorized email origination from affected Joomla systems during the interim period.

SP Page Builder CVE-2026-65879

EUVD-2026-49198 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-07-27 Joomla

GHSA-w26p-j3v2-w753

Authentication Bypass Sp Page Builder Extension For Joomla Joomshaper Com

9.8

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Unauthenticated remote (AV:N/AC:L/PR:N/UI:N) but impact is limited to forging outbound mail sender addresses, so integrity-low only with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 18:32 vuln.today

CVSS changed

Jul 28, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 27, 2026 - 12:55 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 12:55 cve.org

CRITICAL 9.8

DescriptionCVE.org

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.

AnalysisAI

Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in all versions before 6.7.1, where a hardcoded, product-wide secret lets unauthenticated remote attackers forge the 'mail from' address of form submissions. Because the same secret ships across every deployment of the extension, any attacker who knows it can drive the server to send spoofed emails, enabling phishing and spam relayed through the trusted Joomla host. No public exploit code has been identified at time of analysis, EPSS risk is low (0.14%, 4th percentile), and CISA SSVC lists exploitation status as none.

Technical ContextAI

SP Page Builder is a drag-and-drop page/content builder extension for the Joomla CMS, widely used to build landing pages and contact/form components. The root cause is CWE-798 (Use of Hard-coded Credentials): a secret used to validate or sign form/mail parameters is embedded identically in the product across all installations rather than being generated per-site. Because it is not unique per deployment, the secret provides no real trust boundary - anyone with a copy of the extension source (freely inspectable) recovers it and can then craft requests that the mail-handling logic treats as legitimate, in this case controlling the From address of outbound form mail. CPE cpe:2.3:a:joomshaper.com:sp_page_builder_extension_for_joomla identifies the exact affected component.

RemediationAI

Primary fix: upgrade the SP Page Builder extension to version 6.7.1 or later (Vendor-released patch: 6.7.1), which addresses the hardcoded-secret mail forgery; obtain it via the vendor at https://www.joomshaper.com/page-builder and review the disclosure at https://mysites.guru/blog/sp-page-builder-sql-injection-mail-relay-disclosure/. If immediate patching is not possible, restrict or disable the SP Page Builder form/mail submission endpoints (contact and form components) so they cannot be reached by anonymous users - this stops the relay abuse but breaks legitimate site forms until patched. As additional compensating controls, enforce SPF/DKIM/DMARC on the sending domain and monitor outbound mail from the Joomla host for spoofed From addresses or spikes in form-triggered mail, and place the site behind a WAF rule that inspects form submissions to the SP Page Builder handler; these reduce phishing effectiveness and give detection but do not remove the underlying forgeable secret.