Is CVE-2026-37604 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37604 being exploited in the wild.

How severe is CVE-2026-37604?

Critical severity, with a CVSS score of 9.8, published 22 September 2026.

Which products and versions are affected?

pH7Software pH7Builder through 18.2.0.

Is there a fix for CVE-2026-37604?

A patch was published on 2026-09-22: Fixed in version 18.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-37604 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-37604?

Check whether you run pH7Software pH7Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37604: pH7Software pH7Builder IP spoofing authentication bypass

CVE-2026-37604 · Severity: critical · CVSS 9.8 · Published 2026-09-22

pH7Builder is an open-source platform for building dating sites and social networks. The admin login protection uses rate-limiting based on the client IP address, but the application trusts untrusted HTTP headers to determine that IP. An attacker can bypass login attempt throttling by spoofing a different IP address on each password guess, enabling rapid credential guessing without triggering account lockouts.

Technologies: pH7Software pH7Builder. Vendors: pH7Software.

Quick answers

Is CVE-2026-37604 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37604 being exploited in the wild.
How severe is CVE-2026-37604?: Critical severity, with a CVSS score of 9.8, published 22 September 2026.
Which products and versions are affected?: pH7Software pH7Builder through 18.2.0.
Is there a fix for CVE-2026-37604?: A patch was published on 2026-09-22: Fixed in version 18.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-37604 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-37604?: Check whether you run pH7Software pH7Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Ip.class.php, where the application resolves client IP from HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying these come from a trusted proxy. The admin login attempt counter and temporary lockout are keyed on this attacker-controlled IP value, allowing an unauthenticated remote attacker to reset rate-limit state per request by sending a different header value, bypassing all login throttling controls (CWE-290).

Affected products

pH7Software pH7Builder through 18.2.0

Timeline

2026-09-22: disclosed
2026-09-22: patched: Fixed in version 18.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.