Is CVE-2026-65879 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65879 being exploited in the wild.

How severe is CVE-2026-65879?

Informational severity, with a CVSS score of 6.9, published 27 July 2026.

Which products and versions are affected?

JoomShaper SP Page Builder 1.0.0-6.7.0.

Is there a fix for CVE-2026-65879?

A patch was published on 2026-07-27: Fixed in SP Page Builder 6.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65879 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65879?

Check whether you run JoomShaper SP Page Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65879: JoomShaper SP Page Builder unauthenticated mail relay via hardcoded secret

CVE-2026-65879 · Severity: info · CVSS 6.9 · Published 2026-07-27

JoomShaper SP Page Builder, a popular drag-and-drop design tool for Joomla websites, contained a security flaw in its contact form components. Because the software used a single secret password shared across every installation worldwide, attackers could bypass security checks to send unauthorized emails. This effectively turns a legitimate website into an open relay for spam and phishing campaigns, which can severely damage the site owner's domain reputation and lead to email blacklisting.

Technologies: JoomShaper SP Page Builder. Vendors: JoomShaper.

Quick answers

Is CVE-2026-65879 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65879 being exploited in the wild.
How severe is CVE-2026-65879?: Informational severity, with a CVSS score of 6.9, published 27 July 2026.
Which products and versions are affected?: JoomShaper SP Page Builder 1.0.0-6.7.0.
Is there a fix for CVE-2026-65879?: A patch was published on 2026-07-27: Fixed in SP Page Builder 6.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65879 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65879?: Check whether you run JoomShaper SP Page Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the contact-form addons (ajax_contact and form_builder) of SP Page Builder. The extension attempts to prevent tampering with form recipients by signing the recipient address with a secret; however, this secret was hardcoded into the source code (site.php) and was identical across all installations. An unauthenticated attacker can use this known secret to forge valid signatures offline, allowing them to specify arbitrary recipients and spoofed sender addresses. When combined with weaknesses in the built-in captcha and CSRF protections, this allows the component to be used as an open mail relay. The issue is resolved in version 6.7.1 by switching to the unique Joomla site secret for cryptographic signing.

Affected products

JoomShaper SP Page Builder extension for Joomla 1.0.0-6.7.0

Timeline

2026-07-27: patched: Fixed in SP Page Builder 6.7.1
2026-07-27: disclosed: Vulnerability disclosed by mySites.guru
2026-07-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.