SP Page Builder CVE-2026-67287

Q: What is the CVSS score of CVE-2026-67287?

CVE-2026-67287 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-57217 MEDIUM

Improper Access Control (CWE-284)

2026-08-12 Joomla

GHSA-43q2-pmmj-8ph8

Authentication Bypass Sp Page Builder Extension For Joomla Joomshaper Com

6.3

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable, no privileges or interaction needed; only low integrity impact on the vulnerable system with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 14:52 vuln.today

DescriptionCVE.org

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input.

AnalysisAI

Unauthenticated comment creation in SP Page Builder for Joomla (versions prior to 6.8.0) allows remote attackers to bypass the disabled guest commenting restriction by supplying crafted user input that overrides the server-side access control setting. The vulnerability stems from improper access control (CWE-284), where a client-influenced parameter can override a site administrator's explicit configuration decision to disable public commenting. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 6.3 reflects limited integrity impact with no confidentiality or availability consequence.

Technical ContextAI

SP Page Builder is a commercial Joomla CMS extension developed by joomshaper.com (CPE: cpe:2.3:a:joomshaper.com:sp_page_builder_extension_for_joomla:*:*:*:*:*:*:*:*) that provides drag-and-drop page building and content features including a commenting subsystem. The root cause is CWE-284 (Improper Access Control): the extension fails to authoritatively enforce the 'guest commenting disabled' configuration on the server side, instead trusting or accepting a user-supplied value that can override it. This is a classic server-side trust boundary failure - the access control decision is not validated or enforced exclusively in server-controlled state, enabling a remote unauthenticated actor to inject comments that the system's own configuration is meant to prohibit.

RemediationAI

Upgrade SP Page Builder to version 6.8.0 or later, which resolves the improper access control by enforcing the guest commenting restriction server-side regardless of user-supplied input. The vendor advisory and download are available at https://www.joomshaper.com/page-builder. If immediate upgrade is not feasible, a compensating control is to enable comment moderation or review queuing within the extension (if available), so that any comments injected via this bypass are not publicly visible until approved. Alternatively, disabling the commenting feature entirely in SP Page Builder removes the attack surface. There is no evidence that WAF-level blocking of specific parameters is effective without knowing the exact parameter name exploited, so patching remains the authoritative fix.