CVE-2026-108903

EUVD-2026-97066
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 17.77%
Common Weakness Enumeration
References
https://github.com/pH7Software/pH7-Social-Dating-CMS
https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v19.2.0/_protected/app/system/modules/contact/forms/ContactForm.php#L33-L38
https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/4758d7d2ebfd5772faa25ef728c14f8f452e82f4
https://www.vulncheck.com/advisories/ph7builder-before-19.3.0-captcha-bypass-via-client-chosen-form-id