A critical unauthenticated SQL injection vulnerability in the JoomShaper SP Page Builder extension allows remote attackers to perform unauthorized database operations.

This is an SQL injection vulnerability occurring within the Dynamic Content endpoint of the extension. The flaw permits an unauthenticated attacker to manipulate order parameters to inject arbitrary SQL commands.

The ability for an unauthenticated attacker to execute arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to the unauthorized extraction of sensitive database information, including user credentials or site configuration data, justifying the critical CVSS score of 9.2.

Immediate Action: Update the SP Page Builder extension to version 6.7.1 or later immediately.

Proactive Monitoring: Review web server and database access logs for suspicious query patterns or unexpected SQL syntax errors originating from the Dynamic Content endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns until the update can be applied.

Public Exploit Available: No

Given the critical nature of this SQL injection flaw and the ease of access for unauthenticated attackers, administrators must prioritize updating the SP Page Builder extension to version 6.7.1. Failure to patch may result in total database compromise.