Executive brief
SP Page Builder Pro is a popular drag-and-drop page composition extension for Joomla used to create web pages and site layouts. The optin_form addon contains a vulnerability that allows attackers to bypass CAPTCHA verification entirely by supplying their own CAPTCHA configuration values in the HTTP request, bypassing intended bot-prevention controls and enabling unauthorized form submissions.
Technical details
The optin_form addon in SP Page Builder Pro fails to validate CAPTCHA settings against stored configuration; instead it reads the CAPTCHA type, expected answer, and enabled flag directly from user-supplied request parameters. The verification logic uses a weak comparison md5($captcha_question) != $captcha_answer where both operands originate from the attacker-controlled request, making the check trivial to bypass. An unauthenticated remote attacker can forge a request with matching MD5 values to completely bypass CAPTCHA protection on opt-in forms. This affects versions 5.1.4 through 6.9.0.
Affected products
- JoomShaper SP Page Builder Pro 5.1.4 to 6.9.0
Timeline
- 2026-09-14: disclosed