CVE-2026-79701
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In the Joomla extension - SP Page Builder Pro (versions 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0) in the Contact, Opt-in and Form Builder addons, there is an unauthenticated CAPTCHA bypass in module context. In the ajax_contact, optin_form and form_builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was discarded and replaced with a test for a non-empty string whenever the request-supplied view_type parameter equaled 'module'. Submitting view_type=module together with any arbitrary token value therefore passed verification. This affected every instance of these addons placed inside an SP Page Builder module, irrespective of the CAPTCHA type configured for the site, and the view_type parameter was never validated against the context in which the form was actually rendered.
Risk Assessment
The risk includes the possibility of bypassing CAPTCHA protections, which can lead to attack automation, spam, form abuse, and potential further exploits.
Recommendation
It is recommended to immediately upgrade SP Page Builder Pro to a version newer than 6.9.0 and implement additional CAPTCHA verification mechanisms independent of the view_type parameter.
Other vulnerabilities in SP Page Builder Pro
See all- CVE-2026-102426Medium
In the Dynamic Content Filter addon in SP Page Builder Pro versions 3.0.0–5.6.1p2, there is reflected XSS. The slider minimum and maximum values are taken from the dc_filter_<fieldId> parameter, split on "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content.
- CVE-2026-79700Medium
In the SP Page Builder Pro extension (versions 5.1.4 - 6.9.0), the optin_form addon read the CAPTCHA type, expected answer, and enabled flag from the request rather than from the stored addon configuration. Verification reduced to md5($captcha_question) != $captcha_answer with both operands supplied by the attacker, allowing unauthenticated CAPTCHA bypass.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 - In the ajax_contact, optin_form and form_builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was discarded and replaced with a test for a non-empty string whenever the request-supplied view_type parameter equalled module. Submitting view_type=module together with any arbitrary token value therefore passed verification. This affected every instance of these addons placed inside an SP Page Builder module, irrespective of the CAPTCHA type configured for the site, and the view_type parameter was never validated against the context in which the form was actually rendered.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS