CVE-2026-79700: SP Page Builder Pro Auth Bypass Vulnerability

CVE-2026-79700 Overview

CVE-2026-79700 is an unauthenticated CAPTCHA bypass in JoomShaper's SP Page Builder Pro, a commercial page builder extension for Joomla. The flaw affects versions 5.1.4 through 6.9.0 and resides in the optin_form addon. The addon reads the CAPTCHA type, expected answer, and enabled flag from the HTTP request instead of the stored server-side configuration. Verification collapses to md5($captcha_question) != $captcha_answer, where an attacker controls both operands. Any submitted value passes validation, defeating the anti-automation control entirely.

Critical Impact
Unauthenticated attackers can bypass CAPTCHA protection on opt-in forms, enabling automated form submission, mailing list abuse, and spam injection against affected Joomla sites.

Affected Products

JoomShaper SP Page Builder Pro 5.1.4 through 6.9.0
Joomla sites running the optin_form addon
Any deployment relying on the addon's CAPTCHA control for spam prevention

Discovery Timeline

2026-09-14 - CVE-2026-79700 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-79700

Vulnerability Analysis

The vulnerability is a reliance on request-controlled security state, categorized under [CWE-807] (Reliance on Untrusted Inputs in a Security Decision). The optin_form addon in SP Page Builder Pro should retrieve CAPTCHA configuration from the stored addon settings on the server. Instead, it reads the CAPTCHA type, the enabled flag, and the expected answer directly from the incoming HTTP request. This design decision allows a client to fully dictate the parameters used in the subsequent validation check.

Because the check reduces to comparing md5($captcha_question) against $captcha_answer, and the attacker supplies both fields, an attacker can compute a matching pair or disable the check outright via the enabled flag. Successful bypass permits automated submissions to opt-in forms, which feeds spam into subscriber lists, transactional email pipelines, and any downstream workflows triggered by form submissions.

Root Cause

The root cause is trusting client-supplied values for a server-side security decision. The addon does not consult the stored configuration to determine whether CAPTCHA is enabled or what the expected answer is. Both values arrive with the form POST and are used as-is in the validation branch.

Attack Vector

Exploitation is network-based, requires no authentication, and needs no user interaction. An attacker sends a crafted POST request to the opt-in form endpoint with matching captcha_question and captcha_answer values, or with the enabled flag set to false. The submission is accepted as though CAPTCHA validation succeeded. No exploit code is required beyond a standard HTTP client.

Detection Methods for CVE-2026-79700

Indicators of Compromise

Unusually high volumes of opt-in form submissions from a small set of source IP addresses
Form submissions containing CAPTCHA parameters that do not match the site's configured CAPTCHA provider
Requests to the optin_form addon endpoint carrying an explicit enabled or captcha_type field in the body
Sudden growth in mailing list subscriptions with disposable or randomized email addresses

Detection Strategies

Inspect web server access logs for POST requests to SP Page Builder opt-in endpoints and correlate submission rate against baseline traffic.
Add a web application firewall (WAF) rule that flags requests where CAPTCHA-related fields are supplied by the client for the optin_form addon.
Monitor Joomla application logs for repeated form submissions lacking a valid session or Referer consistent with legitimate page visits.

Monitoring Recommendations

Alert on spikes in newsletter or opt-in subscription rates that deviate from historical patterns.
Track outbound mail volume from Joomla-integrated mail transports to identify abuse driven by form spam.
Correlate submission source IPs against threat intelligence feeds for known spam or automation infrastructure.

How to Mitigate CVE-2026-79700

Immediate Actions Required

Upgrade SP Page Builder Pro to a version later than 6.9.0 once JoomShaper publishes a fixed release.
Temporarily disable the optin_form addon on public-facing pages if a patched version is not yet available.
Enforce upstream rate limiting on form submission endpoints via a reverse proxy or WAF.
Review recently created mailing list entries and purge submissions that appear automated.

Patch Information

Refer to the vendor product page at JoomShaper SP Page Builder Pro for the current release notes and fixed version information. Apply the vendor-supplied update to versions above 6.9.0 as soon as it is available.

Workarounds

Front the affected endpoints with a WAF rule that strips or rejects client-supplied captcha_type, captcha_question, captcha_answer, and enabled parameters.
Replace the built-in CAPTCHA with a server-validated third-party provider such as reCAPTCHA or hCaptcha configured through Joomla's global CAPTCHA plugin.
Restrict access to opt-in form endpoints by geography or IP reputation where operationally acceptable.

bash

# Example ModSecurity rule blocking client-supplied CAPTCHA state on the optin_form endpoint
SecRule REQUEST_URI "@contains /index.php" \
  "chain,phase:2,deny,status:403,id:1079700,\
   msg:'CVE-2026-79700 SP Page Builder optin_form CAPTCHA tampering'"
  SecRule ARGS_NAMES "@rx ^(captcha_type|captcha_question|captcha_answer|enabled)$" \
    "t:none,t:lowercase"