CVE Catalog
CVE-2026-67287
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk0.31%
23th percentile - higher than 23% of all known CVEs
Summary
In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create comments even when guest commenting is disabled by overriding the setting with user-supplied input.
Risk Assessment
This could lead to comment spam or inappropriate content on the site, affecting reputation and trust.
Recommendation
Update SP Page Builder to 6.8.0 or later and verify comment permission settings.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input.