CVE-2026-67287

The CVSS score on this CVE is misleading—not because the math is wrong, but because it captures a technical failure while missing the organizational one. The administrative interface showed guest commenting as disabled, yet the enforcement was absent or trivially bypassed through user-supplied input. This is not equivalent to a case where no protection existed at all. Site administrators who checked that box had no log evidence, no warning signals, and no reason to suspect their configuration was theater. They were operating under a materially false premise, and that's the real vulnerability. EPSS scores this at 0.00305, likely reflecting the narrow population of sites running SP Page Builder. But this underweights the organizational impact. Where SP Page Builder powers client-facing sites, an attacker doesn't need sophistication—they need to find environments where an admin trusted a checkbox. The vulnerability becomes a scalpel for targeted exploitation rather than a wide net. What the CVSS cannot capture: whether comment injection leads to stored XSS, whether crafted comments enable phishing via trusted domains, or whether downstream systems consume comment content. The score treats this as medium-low because it's technically just 'comment creation.' You should evaluate the abuse chains specific to your implementation—not stop at the base score. Before accepting the patch, understand what actually changed. Was this a client-side validation bypass moved server-side, or was the parameter override patched directly? The distinction matters for whether similar bypass patterns exist elsewhere in the extension. Ask whether the vendor has introduced process-level changes to prevent configuration bypasses across their codebase, or whether they're patching parameters one-by-one while the underlying architectural gap remains. This is also the fourth or fifth instance of 'configuration toggle bypassed via direct parameter override' in CMS extension ecosystems over fifteen years—WordPress plugins circa 2012, Joomla extensions circa 2016, now SP Page Builder in 2026. The parameter names change. The mechanism doesn't. If the vendor treats this as an isolated incident rather than an architectural symptom, the patch history becomes a reliable predictor of future CVEs.

Reviewed through automated stages and approved by a human before publication.