Is CVE-2026-37603 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37603 being exploited in the wild.

How severe is CVE-2026-37603?

Medium severity, with a CVSS score of 6.5, published 22 September 2026.

Which products and versions are affected?

pH7Software pH7Builder through 19.2.0 (CVE-2026-37603); through 18.2.0 (CVE-2026-37604).

Is there a fix for CVE-2026-37603?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37603 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-37603?

Check whether you run pH7Software pH7Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37603: pH7Software pH7Builder authentication bypass in admin login

CVE-2026-37603 · Severity: medium · CVSS 6.5 · Published 2026-09-22

pH7Builder is a social dating CMS platform that protects administrator login with CAPTCHA challenges, failed attempt counters, and IP-based lockouts. An unauthenticated attacker on the network can bypass all three protections by obtaining a fresh session for each login attempt and spoofing the client IP address, enabling password guessing with no application-level rate limiting.

Technologies: pH7Software pH7Builder. Vendors: pH7Software.

Quick answers

Is CVE-2026-37603 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37603 being exploited in the wild.
How severe is CVE-2026-37603?: Medium severity, with a CVSS score of 6.5, published 22 September 2026.
Which products and versions are affected?: pH7Software pH7Builder through 19.2.0 (CVE-2026-37603); through 18.2.0 (CVE-2026-37604).
Is there a fix for CVE-2026-37603?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37603 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-37603?: Check whether you run pH7Software pH7Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a two-link chain: CVE-2026-37603 stores the CAPTCHA escalation flag in the PHP session, which clients can obtain on demand, removing the challenge; CVE-2026-37604 keys the attempt counter and lockout on a client IP read from request headers, allowing spoofing. Both flaws use deterministic lookups against attacker-supplied keys, rendering the rate-limiting controls ineffective. The vulnerability requires only network access to the admin panel and no prior authentication.

Affected products

pH7Software pH7Builder through 19.2.0 (CVE-2026-37603); through 18.2.0 (CVE-2026-37604)

Timeline

2026-09-22: disclosed
2026-09-19: other: Advisory published by CyberMap Group

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.