CVE-2026-79701: SP Page Builder Pro CAPTCHA Bypass Vulnerability

CVE-2026-79701 Overview

CVE-2026-79701 is an unauthenticated CAPTCHA bypass in JoomShaper's SP Page Builder Pro, a commercial page-builder extension for Joomla. The flaw resides in the ajax_contact, optin_form, and form_builder addons across versions 3.2.6 through 6.9.0. When a form request includes the view_type=module parameter, the application discards the CAPTCHA plugin's onCheckAnswer result and substitutes a non-empty string check. Any arbitrary token value therefore passes verification. The issue is classified under [CWE-807] (reliance on untrusted inputs in a security decision).

Critical Impact
Unauthenticated attackers can bypass CAPTCHA protection on Contact, Opt-in, and Form Builder addons placed inside SP Page Builder modules, enabling automated form abuse regardless of the configured CAPTCHA provider.

Affected Products

JoomShaper SP Page Builder Pro versions 3.2.6 through 6.9.0
Contact, Opt-in, and Form Builder addons rendered inside SP Page Builder modules
Joomla sites using any CAPTCHA plugin with the affected addons

Discovery Timeline

2026-09-14 - CVE-2026-79701 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-79701

Vulnerability Analysis

The vulnerability originates in the server-side CAPTCHA verification logic of three SP Page Builder Pro addons: ajax_contact, optin_form, and form_builder. Under normal operation, the application invokes the configured CAPTCHA plugin's onCheckAnswer event to validate the token submitted with a form. The returned boolean determines whether the submission proceeds.

When the request-supplied view_type parameter equals module, that verification path is skipped. The code discards the plugin result and instead evaluates only whether the submitted CAPTCHA field contains a non-empty string. Any attacker-controlled value therefore satisfies the check.

Because view_type is never validated against the actual rendering context, an attacker can send view_type=module to any endpoint exposing these addons. The bypass applies to every CAPTCHA type the site administrator configures, including reCAPTCHA, hCaptcha, and Joomla's built-in CAPTCHA plugins.

Root Cause

The root cause is a client-controllable branch in the server-side authentication logic. The view_type request parameter is treated as trusted context and routed into a security decision. The design allows an untrusted input to override the outcome of the CAPTCHA plugin, matching the [CWE-807] pattern.

Attack Vector

Exploitation requires only network access to a vulnerable form endpoint. The attacker crafts a standard form POST to the affected addon and adds view_type=module with any placeholder value in the CAPTCHA token field. No authentication, user interaction, or prior reconnaissance beyond identifying an exposed form is required. Refer to the JoomShaper SP Page Builder Pro product page for component context.

Detection Methods for CVE-2026-79701

Indicators of Compromise

Inbound POST requests to SP Page Builder ajax endpoints containing the parameter view_type=module in conjunction with contact, opt-in, or form-builder actions.
Elevated volumes of form submissions from a small set of source IPs or user agents typical of automation frameworks.
Spam, phishing, or fraudulent entries appearing in mailboxes and CRM systems fed by SP Page Builder forms.

Detection Strategies

Inspect web server and WAF logs for the string view_type=module in request bodies to /index.php?option=com_sppagebuilder and related ajax routes.
Correlate form submissions with CAPTCHA provider verification logs; genuine module-context submissions should still show a successful provider callback.
Alert on repeated submissions of the same form with static or malformed CAPTCHA token values.

Monitoring Recommendations

Enable request-body logging on the Joomla front end for endpoints handling ajax_contact, optin_form, and form_builder.
Forward web, application, and mail delivery logs to a centralized analytics platform to correlate form-abuse signals across systems.
Track baseline form submission rates and configure anomaly thresholds per source IP and per form.

How to Mitigate CVE-2026-79701

Immediate Actions Required

Upgrade SP Page Builder Pro to the vendor-supplied fixed release above 6.9.0 as soon as it is published on the JoomShaper site.
Audit all Joomla modules that embed Contact, Opt-in, or Form Builder addons and temporarily disable any that are non-essential.
Review recent form submissions and downstream CRM or email records for spam and fraudulent entries dating back to first exposure.

Patch Information

JoomShaper is the maintainer of SP Page Builder Pro. Administrators should apply the vendor's security update covering versions 3.2.6 through 6.9.0 as soon as it is released. Consult the JoomShaper SP Page Builder Pro product page for current release notes and upgrade guidance.

Workarounds

Deploy a WAF rule that blocks or strips the view_type=module parameter on requests targeting SP Page Builder addon endpoints until a patch is applied.
Restrict access to affected form endpoints by IP allowlist for internal-only forms.
Temporarily unpublish SP Page Builder modules that contain the Contact, Opt-in, or Form Builder addons where feasible.

bash

# Example ModSecurity rule to block the bypass parameter on SP Page Builder endpoints
SecRule REQUEST_URI "@contains com_sppagebuilder" \
  "chain,phase:2,deny,status:403,id:1027901,msg:'CVE-2026-79701 SP Page Builder CAPTCHA bypass attempt'"
  SecRule ARGS:view_type "@streq module" "t:lowercase"