CVE-2026-65879
Received Received - Intake

Unauthenticated Mail Relay in SP Page Builder

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-65879
EUVD
EUVD-2026-49198

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomshaper sp_page_builder to 6.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated mail relay flaw in Joomla extensions from joomshaper.com. It involves a hardcoded secret in SP Page Builder versions before 6.7.1 that allows attackers to forge the mail from address in forms without authentication.

Impact Analysis

Attackers could exploit this to send emails impersonating legitimate users or systems, potentially leading to phishing attacks, spam distribution, or unauthorized communications. Systems using vulnerable versions may be abused for malicious email relaying.

Compliance Impact

This vulnerability allows unauthenticated mail relay via a hardcoded secret, which could enable spoofing of email addresses. This may impact compliance by potentially violating data integrity and confidentiality requirements under GDPR and HIPAA if exploited to send unauthorized or misleading communications.

Mitigation Strategies

Update SP Page Builder to version 6.7.1 or later to remove the hardcoded secret. Remove or restrict access to any exposed forms using this extension until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65879. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart