Unauthenticated Comment Creation in SP Page Builder

Executive Summary

This vulnerability allows an unauthenticated attacker to create comments on Joomla sites using SP Page Builder versions before 6.8.0, even when guest commenting is disabled. The attacker can override this setting by supplying malicious input.

Useful 0 Not Useful 0

Detection Guidance

Check if SP Page Builder versions below 6.8.0 are installed by inspecting the Joomla extension directory or using Joomla's extension manager. Look for unauthorized comments or unexpected user input handling in the application logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could spam comments, post malicious links, or spread misinformation on your Joomla site. This could damage your site's reputation, affect user trust, and potentially expose visitors to security risks.

Useful 0 Not Useful 0

Mitigation Strategies

Update SP Page Builder to version 6.8.0 or later immediately. Disable guest commenting if not required and review all comments for suspicious activity. Monitor for unauthorized access or changes.

Useful 0 Not Useful 0