SP Page Builder Pro CVE-2026-79701

The bypass requires that the target site runs SP Page Builder Pro in the version range 3.2.6-6.9.0 and has at least one of the three affected addons (ajax_contact, optin_form, or form_builder) deployed with a CAPTCHA requirement inside an SP Page Builder module. No authentication is required (PR:N per the provided CVSS 4.0 vector) and no race condition or timing dependency is involved. Exploitation is limited to the specific addons in module context - standard Joomla core forms, contact components outside SP Page Builder, and these same addons when not placed inside a module are unaffected. The bypass does not require knowledge of valid credentials, session tokens, or any site-specific configuration detail beyond identifying an endpoint served by an affected addon.

The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N) accurately reflects the zero-barrier nature of exploitation - no authentication, no race condition, no special configuration beyond using an affected addon. SSVC rates this as automatable with no current active exploitation and partial technical impact. The practical risk is primarily CAPTCHA defeat enabling high-volume spam submissions, automated lead-gen abuse, opt-in list stuffing, and potential denial-of-service against form-processing infrastructure. There is no confidentiality impact (VC:N/VC:N). The absence of an EPSS score in available data prevents probability-of-exploitation quantification, but the trivial one-parameter bypass and SSVC's 'automatable: yes' designation suggest this would see opportunistic mass exploitation if weaponized. Real-world priority is moderate-to-high for any site using these addons with CAPTCHA as a primary anti-spam or anti-abuse control.

An attacker scripts a POST request to any SP Page Builder form endpoint (contact, opt-in, or form builder) on an affected Joomla site, appending view_type=module and a non-empty placeholder CAPTCHA token such as 'x'. The server processes the form without invoking the real CAPTCHA check, allowing the attacker to flood the site with spam submissions, harvest opt-in registrations, or abuse contact form processing pipelines at automated scale. No public proof-of-concept code is noted, but the technique is fully derivable from the public description.