Executive brief
pH7Builder is a social dating CMS platform that protects administrator login with CAPTCHA challenges, failed attempt counters, and IP-based lockouts. An unauthenticated attacker on the network can bypass all three protections by obtaining a fresh session for each login attempt and spoofing the client IP address, enabling password guessing with no application-level rate limiting.
Technical details
This is a two-link chain: CVE-2026-37603 stores the CAPTCHA escalation flag in the PHP session, which clients can obtain on demand, removing the challenge; CVE-2026-37604 keys the attempt counter and lockout on a client IP read from request headers, allowing spoofing. Both flaws use deterministic lookups against attacker-supplied keys, rendering the rate-limiting controls ineffective. The vulnerability requires only network access to the admin panel and no prior authentication.
Affected products
- pH7Software pH7Builder through 19.2.0 (CVE-2026-37603); through 18.2.0 (CVE-2026-37604)
Timeline
- 2026-09-22: disclosed
- 2026-09-19: other: Advisory published by CyberMap Group