Security
SP Page Builder flaw exploited to create Joomla admins
A critical SP Page Builder vulnerability is being exploited against Joomla sites, allowing unauthenticated attackers to upload PHP files and create hidden Super Administrator accounts.
Research published by mySites.guru identifies the affected extension as SP Page Builder, developed by JoomShaper. All versions through and including 6.6.1 are affected; version 6.6.2 contains the fix.
Tracked as CVE-2026-48908, the issue is an improper access control flaw (CWE-284) involving unauthenticated file upload and remote code execution. It carries a CVSS score of 10.0 and is rated Critical. The vulnerable asset.uploadCustomIcon task can be reached without logging in.
mySites.guru says the vulnerability is already being exploited in the wild. Attackers have used it to plant hidden Super Administrator accounts, commonly with email addresses ending in @secure.local, and may leave additional PHP backdoors for persistence.
Administrators should update every affected Joomla site to 6.6.2 or later immediately. Updating only blocks further exploitation, so review Super Administrator accounts, investigate unfamiliar users and inspect compromised sites for malicious files. Unpublishing the extension is not a sufficient mitigation.
Originally reported by mySites.guru.