---
id: CVE-2026-79701
title: >-
  Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module
  Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro
  3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 - In the ajax_contact, optin_form and
  form_build…
summary: >-
  Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module
  Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro
  3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 - In the ajax_contact, optin_form and
  form_build…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-807
vendor: joomshaper.com
product: SP Page Builder (Pro) extension for Joomla
affected:
  - sp_page_builder_pro_extension_for_joomla 3.2.6 - 5.6.1p2
  - sp_page_builder_pro_extension_for_joomla 6.0.0 - 6.9.0
published: '2026-09-14'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T19:17:25.513'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79701'
references:
  - url: 'https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro'
    label: security@joomla.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T14:30:17.303612Z'
cvssSource: cna
epss: 0.00454
epssPercentile: 0.39243
ingestedAt: '2026-09-14T15:23:07.421Z'
---

## Overview

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 - In the ajax_contact, optin_form and form_builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was discarded and replaced with a test for a non-empty string whenever the request-supplied view_type parameter equalled module. Submitting view_type=module together with any arbitrary token value therefore passed verification. This affected every instance of these addons placed inside an SP Page Builder module, irrespective of the CAPTCHA type configured for the site, and the view_type parameter was never validated against the context in which the form was actually rendered.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.