CVE-2026-107637
MediumCVSS 4.3Summary
pH7Builder (pH7 Social Dating CMS) before 18.5.0 has an improper authorization vulnerability in the note module delete() action allowing authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.
Risk Assessment
Authenticated users can modify or delete other users' data, compromising data integrity and trust in the system.
Recommendation
Upgrade to version 18.5.0 or later, which includes a fix checking note ownership permissions.
Other vulnerabilities in pH7Builder
See all- CVE-2026-107638Medium
pH7Builder (pH7 Social Dating CMS) before 18.5.0 has an improper restriction of authentication attempts vulnerability allowing attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers knowing an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts.
- CVE-2026-107636Medium
pH7Builder (pH7 Social Dating CMS) before 18.5.1 has a payment validation vulnerability allowing registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart_order_id, or the PayPal custom field while paying a token amount, or submit uncompleted PayPal IPN payments, to gain the most expensive membership and its paid features.
- CVE-2026-37604Medium
pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request.
- CVE-2026-37603Medium
Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captcha_admin_enabled and the CAPTCHA form element is only built when that flag is present, so a remote unauthenticated attacker who obtains a new session before each login attempt is never presented with the challenge.
Original NVD description (English source)
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS