The vulnerability identified as CVE-2026-66494 affects the SP Page Builder extension for Joomla (versions up to 6.6.2). It is an improper access control issue (CWE-284) combined with a stored cross-site scripting flaw (CWE-79) in the Shapes API endpoint. An unauthenticated attacker can submit a specially crafted HTTP request to store malicious JavaScript code in the Joomla site's database. This code executes automatically when an administrator accesses the SP Page Builder editor, potentially compromising the administrator's session or site integrity. The CVSS 4.0 score is 8.7, reflecting high severity with network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability. No official fix or patch has been documented as of the publication date.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator's browser session when they open the SP Page Builder editor. This can lead to administrative account compromise, unauthorized actions, or further site compromise. The vulnerability impacts confidentiality, integrity, and availability of the Joomla site. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should limit access to the SP Page Builder editor and monitor for suspicious activity. Avoid opening the editor interface from untrusted networks or devices. Follow vendor channels for updates on patches or mitigations.