CVE-2026-79701
Received Received - Intake

Unauthenticated CAPTCHA Bypass in SP Page Builder Pro

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0 - In the ajax_contact, optin_form and form_builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was discarded and replaced with a test for a non-empty string whenever the request-supplied view_type parameter equalled module. Submitting view_type=module together with any arbitrary token value therefore passed verification. This affected every instance of these addons placed inside an SP Page Builder module, irrespective of the CAPTCHA type configured for the site, and the view_type parameter was never validated against the context in which the form was actually rendered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-79701
EUVD
EUVD-2026-77426

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
joomshaper sp_page_builder_pro From 6.9.0 (inc)
joomshaper sp_page_builder_pro to 6.9.0 (inc)
joomshaper sp_page_builder to 6.9.0 (inc)
joomshaper sp_page_builder From 6.9.0 (inc)
joomshaper sp_page_builder_pro From 3.2.6 (inc) to 6.9.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated CAPTCHA bypass in Joomla extensions by joomshaper.com. It affects SP Page Builder Pro versions 3.2.6 to 6.9.0. The flaw allows bypassing CAPTCHA verification by submitting a specific parameter value (view_type=module) with any token, effectively tricking the system into accepting arbitrary inputs as verified.

Detection Guidance

To detect this vulnerability, inspect Joomla sites using SP Page Builder Pro 3.2.6 - 6.9.0 for forms with view_type=module parameter in requests. Check if CAPTCHA bypass is possible by sending test requests with view_type=module and arbitrary tokens to /index.php?option=com_sppagebuilder&task=ajax_contact, optin_form, or form_builder endpoints.

Impact Analysis

An attacker could exploit this to submit unlimited form submissions without CAPTCHA validation, leading to spam, resource exhaustion, or abuse of contact forms, opt-in forms, and form builders. This could disrupt services or enable phishing campaigns through compromised forms.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized form submissions, potentially violating data protection principles under GDPR (e.g., unauthorized processing of personal data) or HIPAA (e.g., unauthorized access to protected health information). Organizations using affected versions must assess exposure and apply mitigations.

Mitigation Strategies

Immediately update SP Page Builder Pro to the latest version beyond 6.9.0. If an update is unavailable, disable the affected addons (ajax_contact, optin_form, form_builder) in SP Page Builder modules. Review server logs for suspicious requests containing view_type=module to identify exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79701. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart