The SP Page Builder extension for Joomla versions 1.0.0 through 6.7.0 contains an unauthenticated SQL injection vulnerability (CWE-89) due to improper validation of order parameters in the Dynamic Content endpoint. This allows remote attackers to inject malicious SQL commands without any authentication or user interaction, potentially compromising the confidentiality and integrity of the underlying database. The vulnerability is tracked as CVE-2026-65766 with a CVSS 4.0 score of 9.2, reflecting its critical severity. As of the published date, no official fix or patch has been announced by the vendor.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data disclosure, data manipulation, or other impacts on the confidentiality and integrity of the system. The high CVSS score indicates significant potential impact on the affected Joomla extension and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the Dynamic Content endpoint or applying web application firewall (WAF) rules to block suspicious SQL injection attempts targeting this component.