The vulnerability resides in versions 5.1.4 to 6 Pro extension for Joomla. The optin_form addon incorrectly reads the CAPTCHA type, expected answer, and the enabled flag from the HTTP request instead an attacker can supply arbitrary values for these parameters. The verification step collapses to a comparison that the attacker can trivially satisfy, effectively allowing CAPTCHA validation to be bypassed. This can enable automated spam, form abuse, and other unauthorized actions that normally require user interaction with a CAPTCHA.

All installations of the SP Page Builder (Pro) extension for Joomla provided by joomshaper.com that are using any version from 5.1.4 up to 6.9.0 are affected. The vulnerability is tied to the optin_form addon bundled with the extension.

The CVSS base score of 6.9 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The issue is exploitable without authentication by manipulating request parameters directed at the optin_form addon. Because the attacker can provide arbitrary CAPTCHA answers, the exploit requires only the ability to send crafted HTTP requests to the extension’s endpoints, which is typically obtainable from any web host that runs Joomla with the vulnerable extension. In practice, automated scripts or bots could exploit the flaw to flood forms or bypass security controls that rely on CAPTCHA verification.