CVE-2026-79700CWE-807

CVE-2026-79700

published September 14, 2026

CVSS
6.9
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The optin_form addon read the CAPTCHA type, the expected answer and the enabled flag from the request rather than from the stored addon configuration. Verification reduced to md5($captcha_question) != $captcha_answer with both operands supplied by the attacker, so any value passed.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00454 · 38.4th percentile
Weakness
CWE-807 · Reliance on Untrusted Inputs in a Security Decision
Published
2026-09-14T15:17Z
References (1)
https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro · [email protected]
EPSS history
Timeline
  • 17 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 14 SEP 10:59Z
    Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0
    cvelistv5