CVE-2026-108903 MEDIUM

CVE-2026-108903: pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID

Vendor Ph7Software
Product ph7builder
Weakness CWE-807
Published October 11, 2026
Last update October 13, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.

Key dates

02Disclosure timeline

October 11, 2026 CVE published
October 13, 2026 Record updated