Update SP Page Builder to 6.9.1 for Six Security Fixes

SP Page Builder 6.9.1 addresses six Joomla extension vulnerabilities affecting Free and Pro installations, including an authenticated blind SQL injection, unauthenticated CAPTCHA bypasses in Pro form addons, and media and menu access-control flaws. Site owners running version 6.9.0 or earlier should plan an update promptly, while administrators of older branches should confirm that earlier security releases have also been applied.

SP Page Builder 6.9.1 is a security-focused update for Joomla sites using the extension’s Free or Pro editions. The release addresses six CVEs whose affected ranges end at 6.9.0. Although the risks and prerequisites differ, the practical response is straightforward: identify the installed version, take a verified backup, update to 6.9.1 or later where the site’s platform supports it, and review the accounts, forms and files most relevant to the affected features.

SP Page Builder 6.9.1 Joomla extension vulnerabilities at a glance

The six vulnerabilities fixed in version 6.9.1 are CVE-2026-78375, CVE-2026-79700, CVE-2026-79701, CVE-2026-81564, CVE-2026-81565 and CVE-2026-81566. The following table uses CVSS 4.0 scores published in the relevant Joomla CNA CVE records. A severity score describes technical impact under the scoring model; it does not establish that a vulnerability has been exploited.

“Not listed” means that these six CVEs are not listed in CISA’s Known Exploited Vulnerabilities catalog in the reviewed evidence. It should not be read as a guarantee that exploitation cannot occur. Patch priority should account for exposure, user roles, public forms and the value of the data handled by the Joomla site.

What the six fixes mean for Free and Pro sites

CVE-2026-78375 affects both Free and Pro releases from 5.2.1 through 6.9.0. It is an authenticated blind SQL injection in the content plugin. The relevant CVE record describes Author-level access as sufficient. This is not an unauthenticated SQL injection: an attacker would first need a qualifying Joomla account. Even so, Author permissions are common on editorial sites and may be held by contractors, contributors or compromised users. The flaw can expose database content, including user and session information.

The two CAPTCHA issues are different in both scope and access requirement. CVE-2026-79700 affects SP Page Builder Pro 5.1.4 through 6.9.0 and concerns the opt-in form addon. CVE-2026-79701 affects Pro 3.2.6 through 6.9.0 and concerns contact, opt-in and form-builder addons when rendered in module context. Both are unauthenticated CAPTCHA bypasses. They affect Pro form addons, not the Free edition. Their likely administrative consequence is weakened anti-bot protection on public forms, making spam and automated form abuse more likely.

The remaining three fixes affect both Free and Pro from 4.0.0 through 6.9.0 and require authenticated access at least equivalent to Author level. CVE-2026-81564 is a path traversal issue that can permit arbitrary file renaming in the Joomla installation. CVE-2026-81565 concerns media uploads that are not adequately confined to the intended directory, allowing files to be written under arbitrary directories beneath the web root. CVE-2026-81566 is an authorization issue that can allow users lacking Joomla com_menus permissions to create or overwrite menu items, including a home menu item. These are reasons to treat lower-privilege publishing and media accounts as part of the site’s security boundary rather than as harmless content-only access.

Update and verification checklist

For sites on 6.9.0 or an earlier compatible release, update SP Page Builder Free or Pro to 6.9.1 or later as soon as practical. Use Joomla’s extension updater where it provides the update, or obtain the package through the vendor’s official SP Page Builder channel. The SP Page Builder product page is the supplied vendor reference for the current product line.

1. Record the current state. Note the Joomla version, SP Page Builder edition and installed version for every site in the portfolio. Agencies should check staging, production and rarely used client sites separately.
2. Create and test a backup. Capture both files and database, and make sure restoration is understood before beginning. A backup that has never been restored is not a tested recovery plan.
3. Update in a controlled sequence. Test the package in a staging copy when possible, then update production. Confirm the extension version after the update rather than relying only on a successful installer message.
4. Perform focused functional checks. Review key pages built with SP Page Builder, test public Pro forms, and inspect modules that render contact, opt-in or form-builder addons.
5. Review privileged accounts. Check Author, Editor, Publisher, Manager and Administrator accounts. Disable accounts no longer needed, investigate unfamiliar accounts or changed group assignments, and enforce appropriate account controls.
6. Inspect menus and media. Compare navigation and home-menu assignments with an approved baseline. Review recent media activity and investigate unexpected files or directories below the web root.

Rate limiting and an additional anti-bot control can reduce the effect of automated submissions while the update is scheduled, but they do not replace the vendor fix for the CAPTCHA issues. Similarly, reducing Author access can lower exposure to authenticated flaws, but it is not a substitute for updating.

Earlier 2026 SP Page Builder fixes still matter

A current 6.9.1 installation includes the later security release, but old branches and unsupported stacks deserve separate attention. Earlier 2026 advisories identified seven additional SP Page Builder vulnerabilities with specific fixed versions. Sites held back on legacy releases should not assume that an earlier update covered later findings.

• CVE-2026-48908: SP Page Builder versions before 6.6.2 are affected by an unauthenticated unrestricted file upload leading to remote code execution. The recommended fixed version is 6.6.2. The CVE record gives this issue a CVSS 4.0 score of 10.0 Critical; the NVD record also contains a CVSS 3.1 score of 9.8 Critical. These are scores from different CVSS versions and should not be treated as directly interchangeable.
• CVE-2026-65766, CVE-2026-65877, CVE-2026-65878 and CVE-2026-65879: releases 1.0.0 through 6.7.0 are affected by, respectively, an unauthenticated SQL injection, authenticated media-manager SQL injection, authenticated arbitrary file deletion and unauthenticated mail relay. The supported fix point is 6.7.1 or later. CVE-2026-65766 has a Joomla CNA CVSS 4.0 score of 9.2 Critical; CVE-2026-65877 is 8.2 High; CVE-2026-65878 is 8.3 High. CVE-2026-65879 has a CVSS 3.1 score of 9.8 Critical in the reviewed record.
• CVE-2026-67285 and CVE-2026-67286: releases 1.0.0 through 6.7.1 are affected by unauthenticated local PHP file inclusion and unauthenticated directory creation/file write, respectively. The stated fix point is 6.8.0 or later. Their Joomla CNA CVSS 4.0 scores are 9.2 Critical and 6.3 Medium.

Joomla 3 is end-of-life. A Joomla 3 site may face compatibility constraints that prevent a clean move to a current SP Page Builder release, and older extension branches may not receive the complete set of fixes. In that situation, the security objective is not to find an indefinite workaround: plan migration away from the unsupported Joomla and extension stack, limit access in the interim, and preserve a restoration path.

Confirmed exploitation, severity and NVD status

Administrators should distinguish a CVSS score from observed exploitation. CVSS is a standardized assessment of vulnerability characteristics; CISA’s Known Exploited Vulnerabilities (KEV) catalog identifies vulnerabilities with evidence of exploitation in the wild.

Of the 13 SP Page Builder CVEs covered here, only CVE-2026-48908 is currently listed in the CISA KEV catalog. CISA confirms active exploitation for that unauthenticated upload-to-code-execution vulnerability. The catalog entry was added on 7 July 2026 and carried a 10 July 2026 remediation due date for relevant U.S. federal civilian executive branch agencies. That date is not a legal deadline for other Joomla site owners, but it is a strong operational signal to check for historical exposure and signs of compromise. The reviewed KEV information marks known ransomware campaign use as Unknown; ransomware use should not be asserted.

There is no authoritative confirmation in the reviewed evidence that the other 12 CVEs are actively exploited. This includes the six fixed in 6.9.1. Their absence from KEV must not delay normal patching, especially on internet-facing sites, but it does require careful language about what is and is not known.

NVD processing is also incomplete for much of this set. NVD lists the July and August CVEs in this article as Deferred, while the September CVEs fixed in 6.9.1 are listed as Received. Those statuses indicate that NVD analysis is not complete and details may change as it progresses. The CVSS 4.0 values in the 6.9.1 table are the Joomla CNA values reported in the CVE records, not newly completed NVD analysis.

Post-update review and incident response

Updating closes the known vulnerable code path going forward; it does not prove that an older site was never accessed. The level of review should match the version and exposure. A site that was below 6.6.2, particularly if internet-facing, deserves the most urgent review because CVE-2026-48908 was exploited in the wild.

• Review web-server and application logs for suspicious activity around the period when a vulnerable version was deployed.
• Inspect the web root for unexpected PHP files and unfamiliar directories, and validate findings against a known-good backup or deployment record.
• Review Joomla administrator accounts and all accounts with Author-level or greater access. Reset credentials and revoke sessions where an account may have been misused.
• Review outbound mail volume, bounces and reputation alerts on systems that previously ran versions below 6.7.1.
• Check page content, media paths, menu items and home-menu assignments for unauthorized changes.
• Preserve relevant logs and files before cleanup if compromise is suspected, then follow the organization’s incident-response process.

The priority is clear: move SP Page Builder to 6.9.1 or later on supported installations, verify older fix levels where a legacy branch remains, and treat account hygiene, form monitoring and filesystem review as complementary controls. This approach addresses the documented Joomla extension vulnerabilities without overstating exploitation claims that the available evidence does not support.

Sources

• CVE record for CVE-2026-78375
• CVE record for CVE-2026-79700
• CVE record for CVE-2026-79701
• CVE record for CVE-2026-81564
• CVE record for CVE-2026-81565 and CVE record for CVE-2026-81566
• CVE record for CVE-2026-48908 and NVD record for CVE-2026-48908
• CISA Known Exploited Vulnerabilities entry for CVE-2026-48908
• SP Page Builder product information