The vulnerability in SP Page Builder Pro (versions 3.2.6 through 6.9.0) arises from improper handling of the CAPTCHA verification result in the ajax_contact, optin_form, and form_builder addons. When the request parameter view_type is set to 'module', the system ignores the actual CAPTCHA plugin's onCheckAnswer event result and instead verifies only that the token string is non-empty. This logic flaw enables attackers to bypass CAPTCHA protections without authentication by submitting any non-empty token with view_type=module. The flaw affects all instances of these addons placed inside SP Page Builder modules, independent of the CAPTCHA type configured. The view_type parameter is not validated against the rendering context, leading to this security decision reliance on untrusted input (CWE-807).

An unauthenticated attacker can bypass CAPTCHA protections in the affected SP Page Builder Pro addons when they are embedded inside modules. This could allow automated or scripted submissions to forms that are intended to be protected by CAPTCHA, potentially leading to spam, abuse, or other unwanted automated interactions. The vulnerability does not require user interaction or privileges and affects all CAPTCHA types configured for the site in the vulnerable addons within modules.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling or not using the affected addons inside SP Page Builder modules or implementing additional CAPTCHA validation controls outside the vulnerable context.