The SP Page Builder Pro extension for Joomla is affected in versions 3.2.6 through 6.9.0. In the ajax_contact, optin_form, and form_builder add‑ons, the result returned by the CAPTCHA plugin's onCheckAnswer event is discarded and replaced with a simple non‑empty string check whenever the request parameter view_type equals module. Submitting a request with view_type=module and any token value therefore passes CAPTCHA verification, allowing a user to submit the form without completing the CAPTCHA. This flaw operates on every such addon placed inside an SP Page Builder module, regardless of the site's configured CAPTCHA type, and the view_type parameter is never validated against the rendering context.

All Joomla sites that use the joomshaper.com SP Page Builder Pro extension at any version between 3.2.6 and 6.9.0 and have the ajax_contact, optin_form or form_builder add‑ons placed within an SP Page Builder module. The bypass occurs regardless of the CAPTCHA type configured for the site and the view_type parameter is not validated against the actual rendering context.

The CVSS score of 6.9 indicates a medium severity flaw. The EPSS score of less than 1% shows a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation at the time of analysis. The attack vector is a web application request; an attacker can craft an HTTP request with view_type=module and an arbitrary token to bypass the CAPTCHA. This bypass is limited to form submissions and does not provide code execution. Because the issue can affect any addon placed inside a SP Page Builder module, an attacker could generate high‑volume spam or abuse across the site.