Quick answers
- Is CVE-2026-79701 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-79701 being exploited in the wild.
- How severe is CVE-2026-79701?
- Informational severity, with a CVSS score of 7.5, published 14 September 2026.
- Which products and versions are affected?
- JoomShaper SP Page Builder Pro 3.2.6 - 6.9.0.
- Is there a fix for CVE-2026-79701?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-79701 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-79701?
- Check whether you run JoomShaper SP Page Builder Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability affects the ajax_contact, optin_form, and form_builder addons in SP Page Builder Pro versions 3.2.6 through 6.9.0. The root cause is improper handling of the CAPTCHA verification response when the view_type parameter is set to "module": the addon discards the CAPTCHA plugin's onCheckAnswer result and replaces it with a simple check for a non-empty token string, effectively bypassing all CAPTCHA validation. The attack requires no authentication and can be exploited remotely by any user able to access the form; the view_type parameter is never validated against the actual rendering context. This affects all instances of these addons placed within SP Page Builder modules regardless of the CAPTCHA type configured site-wide.
Affected products
- JoomShaper SP Page Builder Pro 3.2.6 - 6.9.0
Timeline
- 2026-09-14: disclosed