CVE-2026-79700
Received Received - Intake

Unauthenticated CAPTCHA Bypass in SP Page Builder Pro

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The optin_form addon read the CAPTCHA type, the expected answer and the enabled flag from the request rather than from the stored addon configuration. Verification reduced to md5($captcha_question) != $captcha_answer with both operands supplied by the attacker, so any value passed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-79700
EUVD
EUVD-2026-77382

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomshaper sp_page_builder_pro to 6.9.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated CAPTCHA bypass in the SP Page Builder Pro Joomla extension versions 5.1.4 to 6.9.0. The optin_form addon incorrectly reads CAPTCHA settings like type, expected answer, and enabled flag from user requests instead of the stored configuration. This allows attackers to bypass CAPTCHA by providing matching values for both the question and answer fields.

Detection Guidance

Check if SP Page Builder Pro versions 5.1.4 to 6.9.0 are installed. Inspect network traffic for requests to the optin_form addon that include CAPTCHA-related parameters like captcha_type, captcha_answer, or captcha_enabled. Look for md5 hash comparisons in responses that may indicate CAPTCHA bypass attempts.

Impact Analysis

An attacker could exploit this to bypass CAPTCHA protections on forms, enabling automated submissions for spam, brute force attacks, or unauthorized data access. This could lead to increased server load, data breaches, or compromised user accounts if forms handle sensitive information.

Mitigation Strategies

Update SP Page Builder Pro to the latest version beyond 6.9.0 immediately. Disable the optin_form addon if not required. Implement strict input validation for CAPTCHA-related parameters in Joomla extensions. Monitor for unusual form submissions or CAPTCHA bypass attempts in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart