CVE-2026-108903 Details
Description
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.
A CAPTCHA bypass vulnerability has been identified in pH7Builder (pH7 Social Dating CMS) versions prior to 19.3.0. This vulnerability allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to the PFBC Form::isValid() method. Exploiting this flaw, attackers can load forms that do not require CAPTCHA, such as login or search forms, and then submit their IDs along with data for contact, comments, forums, invites, or signups, thereby automating abuse.
Users can upgrade to pH7Builder version 19.3.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-807 | Reliance on Untrusted Inputs in a Security Decision | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pH7Builder | >= 0, < 19.3.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |