A flaw in the SP Page Builder extension for Joomla permits any visitor to upload files to the site, and those files are then executed as PHP scripts. Based on the description, it is inferred that the upload endpoint lacks proper file type validation or authentication checks, enabling attackers to place malicious code in a directory that the web server treats as executable.

The vulnerable component is the SP Page Builder extension published by joomshaper.net for Joomla. All releases of this extension older than version 6.6.2 are affected, as the title and vendor guidance indicate the issue is limited to versions before the 6.6.2 release. Users with any older version of the extension that have not applied the vendor’s fix remain at risk.

The CVSS score of 10 signals a critical severity. The EPSS score of 15% suggests a moderate probability that attackers will target this weakness. Because the flaw allows unauthenticated uploads with no type checking, an attacker can simply craft a request to the upload endpoint, upload a PHP file, and trigger its execution. The vulnerability is listed in the U.S. CISA Known Exploited Vulnerabilities catalog, indicating that exploitation may already be occurring in the wild.