SP Page Builder EUVD-2026-57217

Exploitation requires that the target Joomla site has SP Page Builder installed at a version below 6.8.0 AND that the site administrator has explicitly disabled guest commenting within SP Page Builder's settings. Sites where guest commenting is already enabled are not meaningfully affected, as the attacker's action (posting a comment) would be permitted by policy regardless. No authentication is required; the attack is network-reachable and requires no user interaction. The limiting factor is the specific deployment configuration: only instances where the admin attempted to restrict public comment creation are vulnerable to bypass - a self-selecting population of more security-conscious deployments.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) scores 6.3, reflecting a moderate, network-reachable, unauthenticated integrity violation with attack condition AT:P - meaning exploitation specifically targets instances where guest commenting has been explicitly disabled by the administrator. This is a meaningful real-world constraint: sites with guest commenting enabled are not affected, limiting the exploitable surface to those instances that attempted to harden their comment policy. The impact is limited to low-integrity writes (comment spam or unwanted content injection), with no confidentiality or availability effect. No EPSS data, KEV listing, or public proof-of-concept was provided, placing this in a lower-urgency tier despite network reachability. The primary business risk is content integrity degradation and potential spam/abuse vectors on sites with comment moderation disabled, not system compromise.

An unauthenticated remote attacker identifies a Joomla site running SP Page Builder with guest commenting disabled - a configuration intended to restrict public comments. By crafting an HTTP request that includes a user-supplied parameter overriding the disabled-commenting control, the attacker posts comments to pages without any authentication, bypassing the administrator's access policy. No public proof-of-concept code has been identified at time of analysis, but the vulnerability class (parameter override of a boolean access control) is straightforward to exploit once discovered.