The SP Page Builder extension for Joomla contains a flaw that lets an unauthenticated attacker upload arbitrary files, ultimately allowing execution of PHP code on the server. The upload process does not validate the file type or enforce proper access controls, enabling a malicious actor to deliver a PHP file that the application subsequently executes. This vulnerability results in full remote code execution, giving attackers control over the Joomla instance and the ability to modify content, deploy additional malware, or compromise other systems on the same server.

SP Page Builder extension for Joomla from joomshaper.net is vulnerable in all versions prior to 6.6.12. Any Joomla installation that has not upgraded to 6.6.12 or later is at risk.

The CVSS score is 10, indicating critical severity. EPSS data is not available, so the exact probability of exploitation cannot be quantified, but the absence of authentication checks and the ease of uploading arbitrary files suggest a high likelihood of abuse. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by sending a crafted file upload request to the SP Page Builder upload endpoint; because the system allows unauthenticated uploads, the attacker can place a PHP file that the site later executes, providing a simple and low‑complexity attack path with high impact.