CVE-2026-79701 in SP Page Builder Extension
Summary
by MITRE • 09/14/2026
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0 - In the ajax_contact, optin_form and form_builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was discarded and replaced with a test for a non-empty string whenever the request-supplied view_type parameter equalled module. Submitting view_type=module together with any arbitrary token value therefore passed verification. This affected every instance of these addons placed inside an SP Page Builder module, irrespective of the CAPTCHA type configured for the site, and the view_type parameter was never validated against the context in which the form was actually rendered.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified within Joomla extensions developed by joomshaper.com represents a critical authentication bypass flaw affecting specific addons in SP Page Builder Pro versions 3.2.6 through 6.9.0. This security issue specifically impacts the ajax_contact, optin_form, and form_builder modules when they are deployed within an SP Page Builder module context. The core technical deficiency lies in how these components handle CAPTCHA verification during AJAX requests. When a user interacts with one of these forms, the system is expected to validate that the submitted response matches the challenge issued by the configured CAPTCHA plugin via its onCheckAnswer event. However, due to flawed logic within the request handling routine, the actual result returned by this validation process is discarded rather than utilized for access control decisions.
Instead of relying on the cryptographic or heuristic proof provided by the CAPTCHA service, the application performs a simplistic check to determine if the submitted token string is non-empty. This logical error becomes exploitable specifically when the request-supplied view_type parameter equals module. In this specific context, the code path ignores the actual verification outcome and proceeds as long as some value is present in the token field. Consequently, an attacker can bypass CAPTCHA protections entirely by submitting a form with any arbitrary non-empty string for the token, effectively rendering the anti-bot mechanism useless against automated attacks or brute-force attempts targeting these forms.
The operational impact of this vulnerability is significant because it affects every instance of the affected addons placed inside an SP Page Builder module, regardless of which CAPTCHA type was configured by the site administrator. Whether the site utilizes Google reCAPTCHA, hCaptcha, Cloudflare Turnstile, or a custom solution, the bypass logic remains consistent and effective. This lack of context validation means that the view_type parameter is never checked against the actual rendering environment to ensure proper security enforcement. As a result, attackers can automate submissions for contact forms, newsletter opt-ins, and other user-generated content inputs without solving CAPTCHA challenges, leading to potential spam accumulation, data scraping, credential stuffing if login fields are involved, or denial of service through resource exhaustion via high-volume automated requests.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication because the system fails to properly verify that an entity is who it claims to be during the CAPTCHA validation step. It also relates to CWE-601 URL Redirection to Untrusted Destination in terms of logic flow if redirects are involved, but more accurately fits CWE-915 Improper Modification of Functionally Essential Object as the application modifies the essential security check outcome by discarding the valid verification result. In the MITRE ATT&CK framework, this behavior facilitates Initial Access and potentially Impact categories such as Data Exfiltration or Disruption via Denial of Service, depending on how the attacker leverages the bypassed forms to interact with backend systems without human intervention.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is for users to update SP Page Builder Pro to a version where this logic error has been corrected, ensuring that the CAPTCHA verification result is properly evaluated rather than discarded based on arbitrary parameter values. For administrators unable to patch immediately, implementing server-side WAF rules can help by inspecting incoming AJAX requests and rejecting those with view_type=module if they do not contain valid tokens from recognized providers. Additionally, developers should enforce strict input validation where the context of the request is verified against expected parameters before processing sensitive logic. Ensuring that security controls are tied to the actual execution context rather than mutable client-side or easily spoofed HTTP parameters is essential for preventing similar bypasses in future development cycles.