This critical vulnerability in JoomShaper SP Page Builder is currently being actively exploited in the wild, posing an immediate risk of full system compromise.

The application suffers from an unrestricted file upload vulnerability (CWE-434), which allows an unauthenticated remote attacker to upload malicious files. This flaw can lead to remote code execution (RCE) by bypassing file type restrictions.

Successful exploitation of this vulnerability grants an attacker full control over the affected web server, leading to potential data exfiltration, site defacement, or total system compromise. With a CVSS score of 9.5 and confirmed active exploitation as noted by CISA KEV, this vulnerability represents an extreme risk to business continuity and data integrity.

Immediate Action: Update the SP Page Builder extension to the latest patched version provided by JoomShaper immediately.

Proactive Monitoring: Review web server access logs for suspicious file uploads or requests to unfamiliar files within the upload directories.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized file upload attempts and restrict access to administrative directories.

Public Exploit Available: Yes

Due to the confirmed active exploitation and the critical nature of the flaw, organizations must prioritize patching this vulnerability immediately. Failure to remediate could result in immediate unauthorized access and total loss of administrative control over the affected Joomla environment.