CVE-2026-108903 — pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chos…
Published: 2026-10-11 · CVSS: 6.9 · CVSS 4.0
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7