CVE-2026-79701: Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0 - In the ajaxcontact, optinform and formbuilder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was discarded and replaced with a test for a non-empty string whenever the request-supplied viewtype parameter equalled module. Submitting viewtype=module together with any arbitrary token value therefore passed verification. This affected every instance of these addons placed inside an SP Page Builder module, irrespective of the CAPTCHA type configured for the site, and the viewtype parameter was never validated against the context in which the form was actually rendered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SP Page Builder Pro (joomshaper.com) - ajax_contact, optin_form, form_builder addons (Module context CAPTCHA bypass)to a version that resolves this vulnerability.Fixed in 6.9.0 - Configuration
In the ajax_contact, optin_form, and form_builder addons, ensure the result from the CAPTCHA plugin's onCheckAnswer event is used for verification and remove any logic that discards it and substitutes a non-empty-string check when request view_type equals module.
Joomla Extension - joomshaper.com (SP Page Builder Pro) CAPTCHA view_type context validation = Validate view_type parameter against the context where the form is actually rendered; do not trust request-supplied view_type values (e.g., view_type=module) to bypass CAPTCHA results
Event History
Frequently Asked Questions
Which deployments are affected?
Every Contact, Opt-in, or Form Builder addon instance placed inside an SP Page Builder module is affected in versions 3.2.6 through 6.9.0. The configured CAPTCHA type does not change exposure.
What does an attacker need to bypass CAPTCHA verification?
No authentication is required. An attacker can submit the form request with view_type=module and any non-empty arbitrary token value, because the request parameter is not validated against the form's actual rendering context.