Executive brief
phpList is an open-source email marketing platform used to manage subscriber lists and send newsletters. A cross-site request forgery (CSRF) vulnerability in versions before 3.6.17 allows attackers to trick administrators into unknowingly deleting and blacklisting subscriber accounts by visiting a malicious webpage, resulting in permanent loss of subscriber data and potential business disruption.
Technical details
The vulnerability is a Cross-Site Request Forgery (CWE-352) in the mass subscriber removal handler (public_html/lists/admin/massremove.php). The endpoint processes POST requests to delete and blacklist subscriber addresses without validating CSRF tokens; phpList's verifyToken() and verifyCsrfGetToken() functions are not called. An attacker can host a malicious HTML page with a hidden form that, when visited by a logged-in administrator, silently submits a POST request to perform arbitrary subscriber deletions and blacklisting. No additional authentication or user interaction beyond visiting the page is required. The fix was released in version 3.6.17 by adding proper CSRF token verification to the affected endpoint.
Affected products
- phpList phpList before 3.6.17
Timeline
- 2026-05-28: disclosed: Vulnerability reported via email for versions <= 3.6.15
- 2026-06-03: other: Confirmed vulnerable in version 3.6.16 as well
- 2026-09-16: patched: Fix released in version 3.6.17
- 2026-09-16: advisory: Public disclosure of CVE-2026-92806