CVE-2026-65879 PUBLISHED

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1

Assigner: Joomla
Reserved: 23.07.2026 Published: 27.07.2026 Updated: 27.07.2026

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.

Product Status

Vendor joomshaper.com
Product SP Page Builder extension for Joomla
Versions Default: unaffected
  • Version 1.0.0-6.7.0 is affected

Credits

  • Phil Taylor finder

References