CVE-2026-78375

The content plugin shipped with JoomShaper SP Page Builder (Free and Pro) versions 5.2.1 through 6.9.0 contains an authenticated SQL injection in plgContentSppagebuilder::onContentAfterSave(): the jform[attribs][sppagebuilder_article_id] value from the request is concatenated directly into a WHERE view_id = ... clause querying #__sppagebuilder, with no quoting or type casting. Because Joomla's ARRAY input filter returns the array with element values untouched, the entire payload can be delivered in a single POST field, and because the vulnerable block executes before the com_content.article context test, it runs on every onContentAfterSave event regardless of which component triggered the save. An authenticated user with privileges sufficient to trigger a content save (CVSS 4.0: 8.6 high, PR:H) can exploit this as time-based blind SQL injection to read arbitrary database contents, including the #__users and #__session tables, enabling credential-hash and session-token theft and full site compromise. Any Joomla site running SP Page Builder Free or Pro 5.2.1–6.9.0 with the content plugin enabled is affected, including sites that received the extension bundled with JoomShaper templates. No public proof-of-concept exists, no exploitation in the wild has been reported, and the flaw is not on the CISA KEV list.

What to do: Update SP Page Builder (Free and Pro) to the latest release, which is newer than 6.9.0 and contains the fix. If patching must be deferred, disable the SP Page Builder content plugin (plgContentSppagebuilder) where it is not needed and restrict content-authoring privileges (Author level and above) to fully trusted users, since exploitation requires an authenticated, privileged trigger. Review logs for POST requests carrying jform[attribs][sppagebuilder_article_id] with non-numeric or oversized values, and audit #__users and #__session for signs of extraction such as unexpected administrator accounts or hijacked sessions.