Joomla SP Page Builder zero-day lets attackers plant hidden admins

Administrators of Joomla-powered websites are being urged to patch immediately after attackers began exploiting a critical zero-day in SP Page Builder, the widely deployed page-building extension from JoomShaper. Tracked as CVE-2026-48908, the flaw carries a CVSS 4.0 base score of 10.0 and a CVSS 3.1 score of 9.8, and it was added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog on 7 July 2026 with a federal remediation deadline of 10 July.

The vulnerability is an unrestricted upload of a file with a dangerous type (CWE-434) in the extension’s asset.uploadCustomIcon task. Because the endpoint accepts a file with no authentication and no check on file type, a remote attacker can POST a malicious PHP file to index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon and then execute it as a web shell.

Investigators observed the flaw used as a genuine zero-day. After uploading a PHP payload, attackers created new hidden Joomla Super User accounts, giving them persistent administrative access even after the upload path is closed. Site owners are advised to check for unexpected Super User accounts and unfamiliar PHP files in web-served directories.

All releases from 1.0.0 through 6.6.1 are affected. JoomShaper has fixed the issue in SP Page Builder 6.6.2. Because the extension powers large numbers of business and government sites across the MENA region, the pool of exposed targets is broad, and every operator running it should update without delay and audit their sites for signs of compromise rather than assume patching alone is enough.

Sources: NVD: CVE-2026-48908 CISA Known Exploited Vulnerabilities Catalog

Drafted with AI assistance and reviewed by the IT Magazine news desk. Facts verified against the linked sources. Spotted an error? See our Corrections Policy.