Answer in brief
CVE-2026-79701 records a Medium severity (CVSS 6.9) vulnerability in Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0. The current sources do not mark it as known exploited. The current feed maps joomshaper.com/SP Page Builder (Pro) extension for Joomla (generic), joomshaper.com/SP Page Builder (Pro) extension for Joomla (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps joomshaper.com/SP Page Builder (Pro) extension for Joomla (generic), joomshaper.com/SP Page Builder (Pro) extension for Joomla (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| joomshaper.com/SP Page Builder (Pro) extension for Joomlageneric | 3.2.6 - 5.6.1p2 || 6.0.0 - 6.9.0 | Not reported |
| joomshaper.com/SP Page Builder (Pro) extension for Joomlageneric | 3.2.6 - 6.9.0 | Not reported |
Published upstream
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 14, 2026
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 - In the ajax_contact, optin_form and form_builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was discarded and replaced with a test for a non-empty string whenever the request-supplied view_type parameter equalled module. Submitting view_type=module together with any arbitrary token value therefore passed verification. This affected every instance of these addons placed inside an SP Page Builder module, irrespective of the CAPTCHA type configured for the site, and the view_type parameter was never validated against the context in which the form was actually rendered.
Quoted source text, attributed separately from HOL analysis.