First of all, all our templates are secure. The vulnerability was found in the SP Page Builder component up to version 6.7.1, which has been fixed in version 6.8.0 Therefore, you should update to that version as soon as possible. The updated version is available in the downloads section.
 .

What to do?
First, check if there are more Superusers than the ones you created. They usually have @secure.local privileges. If any exist, disable them. Back up everything, including files and the database. You can do this using Akeeba, manually, or through your hosting provider. Then, install version 6.6.2 of SP Page Builder, which includes the security patch.

If you don't find the extra Superuser privilege, immediately update SP Page Builder and all your extensions, including Joomla.

For more information on what to check and how to proceed if your site has been compromised, see mysites.guru/blog/sp-page-builder-zero-d...ploadcustomicon-rce/

NOTE 1: This security issue is not a problem with our templates; it's a problem with SP Page Builder.

NOTE 2: If you have installed the JCE editor, you should also update to its latest version, which also had a similar security issue. You can read about it here: mysites.guru/blog/finding-every-site-running-a-vulnerable-jce/ or find more posts about this problem here: mysites.guru/blog/

UPDATE: 12/08/2026
In addition to the vulnerabilities and their patches mentioned, a new remote injection vulnerability has been discovered up to version 6.7.1, which is patched in version 6.8.0. Therefore, updating is mandatory.