This vulnerability in joomshaper.net's SP Page Builder extension for Joomla (versions 1.0.0 through 6.6.1) allows unauthenticated attackers to upload files without restriction on file type. This can lead to the upload and execution of arbitrary PHP code on the affected system. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and results in a critical security risk due to the potential for remote code execution without any authentication or user interaction required.

Successful exploitation allows an unauthenticated attacker to upload and execute arbitrary PHP code on the server running the vulnerable SP Page Builder extension. This can lead to full system compromise, data theft, service disruption, or further attacks within the affected environment. The CVSS 4.0 score of 10.0 reflects the highest impact with network attack vector, no privileges or user interaction required, and high confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor the vendor's security advisories for updates. As a temporary mitigation, restrict access to the upload functionality if possible, or disable the SP Page Builder extension until a patch is released.