July 14, 2026 · Alastor InfoSec Team
CVE-2026-48908: JoomShaper SP Page Builder CVSS 10.0 Unauthenticated RCE — Patch to 6.6.2 Immediately
If you run a Joomla-based website using JoomShaper's SP Page Builder extension, you have an unauthenticated remote code execution vulnerability with a maximum CVSS score of 10.0 sitting on your server right now — unless you have already updated to version 6.6.2. CVE-2026-48908 was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on July 7, 2026, confirming active exploitation in the wild. This is not a theoretical risk.
What Is CVE-2026-48908?
CVE-2026-48908 is an unrestricted file upload vulnerability in the asset.uploadCustomIcon controller within SP Page Builder for Joomla. The controller — intended to allow admins to upload custom icons — failed to enforce three basic security controls simultaneously: it required no authentication, checked no anti-CSRF token, and performed no file-type validation.
The practical result is that any anonymous HTTP request can POST a PHP script to the uploadCustomIcon endpoint and have that script written into a web-accessible directory on the server. From there, a single GET request to the uploaded file achieves remote code execution. The attack chain requires no privileges, no social engineering, no user interaction, and no prior access to the system. An attacker with internet access and a tool like curl can fully compromise an unpatched Joomla server in seconds.
Technical Details
CVE: CVE-2026-48908
CVSS v4.0 Score: 10.0 (Critical)
CWE: CWE-284 (Improper Access Control) / CWE-434 (Unrestricted Upload of File with Dangerous Type)
Attack Vector: Network
Authentication Required: None
User Interaction: None
Affected Versions: SP Page Builder for Joomla versions up to and including 6.6.1
Fixed Version: 6.6.2 (released June 14, 2026)
CISA KEV Added: July 7, 2026
What Attackers Are Doing
Based on threat intelligence aligned with the CISA KEV listing, exploitation of CVE-2026-48908 follows a predictable pattern: automated scanners identify Joomla installations with SP Page Builder, probe the uploadCustomIcon endpoint without authentication, upload a lightweight PHP webshell, and then use that webshell for second-stage payload delivery or to establish persistence.
Observed second-stage activity includes credential harvesting from Joomla's configuration files (which typically contain database credentials), lateral movement attempts within shared hosting environments, and deployment of cryptomining payloads and information stealers. In some cases, compromised servers are being used as infrastructure for phishing campaigns targeting the site's own users — a scenario with serious implications under India's DPDPA if personal data is exfiltrated as a result.
The vulnerability was disclosed on June 14, 2026, when JoomShaper released the patched version. By July 7, CISA had confirmed it was actively being exploited — a window of less than 23 days from patch availability to KEV listing. That is an unusually fast exploitation timeline and reflects how aggressively threat actors are scanning for newly disclosed CMS plugin vulnerabilities.
Who Is at Risk
SP Page Builder is one of the most widely used page builder extensions in the Joomla ecosystem, with installations across e-commerce sites, educational platforms, government portals, and corporate websites. Any Joomla installation running SP Page Builder 6.6.1 or earlier with internet-accessible admin endpoints — or even just with the plugin installed and web server running — is potentially vulnerable. You do not need to be running a high-profile website to be targeted; automated exploitation means low-traffic sites are just as likely to be hit as enterprise deployments.
Remediation Steps
The fix is straightforward. Update SP Page Builder to version 6.6.2 or later via the Joomla extension manager. Version 6.6.2 gates the uploadCustomIcon controller behind an authenticated session, enforces a required admin or component-manage permission level, implements an anti-CSRF token check, and adds file-type validation. All four controls that were missing are now present.
If you cannot update immediately, the interim mitigations are to disable the SP Page Builder extension entirely via the Joomla extension manager, or to block access to the /components/com_sppagebuilder/ path at the web server or WAF level. Neither is a permanent fix — update to 6.6.2 as soon as possible.
After patching, conduct a post-compromise audit: check recently modified files in your Joomla installation (particularly in uploads/, images/, and component directories), review web server access logs for unexpected POST requests to uploadCustomIcon, audit database users and configuration files for credential exposure, and verify that no new Joomla administrator accounts were created.
The Bigger Picture: CMS Plugin Supply Chain Risk
CVE-2026-48908 is the latest in a consistent pattern of critical vulnerabilities in popular CMS plugins — Joomla extensions, WordPress plugins, and Drupal modules are among the highest-value targets for threat actors precisely because they are deployed at scale across thousands of websites with inconsistent patch management. The Joomla ecosystem alone saw four CVEs added to CISA KEV in July 2026.
This is an argument for treating your CMS plugin inventory as a first-class attack surface. Many organisations conduct web application VAPT against their core application while neglecting the plugins and extensions that extend it. A plugin with a CVSS 10.0 unauthenticated RCE bypasses every security control on the application layer.
How Enforster AI Helps
Enforster AI, our AI-powered SAST, DAST, and attack surface management engine, continuously monitors your web applications — including Joomla, WordPress, and Drupal deployments — for newly disclosed CVEs in installed plugins and extensions. Rather than waiting for a manual penetration test to surface a critical plugin vulnerability, Enforster AI identifies vulnerable components as part of continuous attack surface monitoring, prioritises them by CVSS score and exploitation status, and maps each finding to your remediation workflow.
For organisations that received a green light on their last web application pentest but have not reviewed their plugin inventory since, a targeted assessment is worth scheduling now.
Reach out to [email protected] to discuss a plugin security audit or continuous attack surface monitoring engagement, or visit Enforster AI for details.
CVE-2026-48908 is a CVSS 10.0, zero-authentication RCE that has been actively exploited since within weeks of disclosure — if you are running SP Page Builder 6.6.1 or earlier, updating to 6.6.2 is the only acceptable response.