CVE-2026-79700 in SP Page Builder Pro Extension
Summary
by MITRE • 09/14/2026
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The optin_form addon read the CAPTCHA type, the expected answer and the enabled flag from the request rather than from the stored addon configuration. Verification reduced to md5($captcha_question) != $captcha_answer with both operands supplied by the attacker, so any value passed.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in SP Page Builder Pro versions 5.1.4 through 6.9.0 represents a critical failure in input validation and security control implementation within the optin_form addon component of Joomla-based websites. This flaw allows unauthenticated attackers to bypass CAPTCHA mechanisms, which are designed specifically to prevent automated abuse such as spam submissions, credential stuffing, and denial-of-service attacks against forms. The root cause lies in how the application handles configuration data for the CAPTCHA module during runtime execution. Instead of retrieving the security parameters from a persistent storage layer where they are intended to be managed by administrators, the software incorrectly reads the CAPTCHA type, the expected answer value, and the enabled flag directly from the HTTP request payload submitted by the client. This architectural decision fundamentally undermines the integrity of the verification process because it places trust in data that is entirely under the control of the end user rather than a trusted server-side source.
From a technical perspective, the vulnerability manifests through a flawed comparison logic used to validate CAPTCHA responses. The application employs an MD5 hash check where both operands are derived from attacker-supplied input. Specifically, the system calculates the MD5 hash of the captcha question provided in the request and compares it against the md5 value of the captcha answer also supplied by the user. Because the attacker controls both sides of this equality check, they can trivially construct a valid response that satisfies the condition without ever solving the actual CAPTCHA challenge or interacting with an external verification service like Google reCAPTCHA or hCaptcha. This effectively renders the security control inert, as any arbitrary string passed in the request will result in a successful authentication if the attacker simply ensures their provided answer matches the hash of their provided question.
The operational impact of this vulnerability is severe for organizations relying on SP Page Builder Pro to manage contact forms, newsletter subscriptions, or login mechanisms protected by CAPTCHAs. Attackers can automate interactions with these endpoints at scale, leading to increased spam traffic, compromised user data through brute-force attacks if the form handles authentication, and potential resource exhaustion due to unlimited automated submissions. Furthermore, this bypass could facilitate account takeover attempts if the vulnerable component is integrated into a registration or password reset workflow that relies on CAPTCHA as its primary anti-automation measure. The lack of server-side validation means that legitimate users are not protected from bots, while malicious actors face no barrier to exploiting these endpoints repeatedly.
This issue aligns with CWE-287, which describes Improper Authentication, specifically the failure to verify credentials or security tokens correctly due to reliance on client-supplied data for critical decisions. It also relates to CWE-601, URL Redirection to Untrusted Site (Open Redirect), in a broader sense of trusting unverified input, but more accurately fits CWE-829, Inclusion of Functionality from Untrusted Control Sphere, as the application logic is dictated by external request parameters rather than internal configuration. From an ATT&CK perspective, this vulnerability facilitates Initial Access and potentially Credential Access if used against authentication forms, falling under techniques that involve exploiting software vulnerabilities to bypass security controls.
Mitigation strategies must focus on correcting the data source for critical security configurations. Developers should ensure that CAPTCHA settings are retrieved exclusively from secure server-side storage or configuration files rather than HTTP request parameters. The application logic must enforce a strict separation between user input and system configuration, ensuring that only validated form fields are processed while structural security parameters remain immutable during runtime unless explicitly changed by an authenticated administrator via a protected administrative interface. Additionally, implementing rate limiting and IP-based throttling can provide a secondary layer of defense against automated abuse even if the CAPTCHA is bypassed. Organizations running affected versions should immediately update to patched releases provided by joomshaper.com or apply manual code patches that rectify the data retrieval logic for the optin_form addon to restore the intended security posture.