Active Exploitation of Joomla SP Page Builder RCE Drives Mass Scanning

FortiGuard Labs reported ongoing in-the-wild exploitation of CVE-2026-48908, a critical CVSS 10.0 unauthenticated remote code execution flaw in the JoomShaper SP Page Builder extension for Joomla. The bug stems from an unrestricted file upload in the asset.uploadCustomIcon functionality that lets attackers upload and execute arbitrary PHP files, enabling full server compromise. Public proof-of-concept exploit code is available, and the vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog after active abuse was confirmed.

FortiGuard said exploitation has remained elevated, with 1,210 blocked attempts in 24 hours and 15,626 over 7 days, indicating sustained automated scanning of Internet-facing Joomla servers. The highest attack volumes were observed against organizations in Poland, Turkey, Australia, and the United States, with Telecommunications/Carrier and Technology among the most targeted sectors. Defenders were urged to upgrade to SP Page Builder 6.6.2 or later, restrict public access to Joomla administrative interfaces, block PHP execution in upload directories, and investigate for web shells, suspicious files, unauthorized administrator accounts, and other persistence because patching alone does not remove an existing compromise.