CVE-2026-65876 is an SQL injection vulnerability in the SP Page Builder extension for Joomla, specifically affecting versions up to 6.7.1. The vulnerability is due to improper neutralization of special elements in the 'catid' parameter within the loadMoreArticles endpoint, enabling unauthenticated attackers to execute arbitrary SQL commands. This can lead to unauthorized data access or manipulation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and security capabilities.

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, data modification, or other impacts on data integrity and confidentiality. Given the critical CVSS score, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, restrict access to the vulnerable endpoint if possible and monitor for suspicious activity related to the loadMoreArticles endpoint.