SP Page Builder 6.7.1 still contains an unauthenticated SQL injection in the front-end article loading endpoint. The 6.7.1 security release did not close it.
The site controller task articles.loadMoreArticles reads its parameters straight out of the raw JSON request body (php://input) with no login, no permission check and no CSRF token of any kind. The catid value taken from that body is passed unfiltered into SppagebuilderHelperArticles::getCategories(), which interpolates the array directly into a SQL IN() clause with implode(). The ArrayHelper::toInteger() sanitisation added for the sibling query runs one line too late to protect that call.
Any anonymous visitor can therefore read the entire site database, including user records and password hashes. Confirmed by reading the shipping com_sppagebuilder_pro 6.7.1 package on 10 August 2026.
This is reported to be under active exploitation in the wild. JoomShaper has NOT released a patch. The vendor has published a 6.8.0 changelog entry stating "Fixed an unauthenticated SQL injection in the article loading endpoint" and says the release is due "in the next days or week".
As of 10 August 2026 the latest available download is still 6.7.1, so there is currently no version you can update to. Temporary mitigation until 6.8.0 is published: edit components/com_sppagebuilder/controllers/articles.php and add die(); as the very first statement inside the loadMoreArticles() function. This blocks the attack. It also disables the endpoint, so the "Load more" button on article list addons will stop working until you remove the line.
This is separate from CVE-2026-65766 (the Dynamic Content ORDER BY injection), which was genuinely fixed in 6.7.1.
