CVE-2026-108903: pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
pH7Builder versions before 19.3.0 are affected. The issue applies to deployments exposing forms that rely on CAPTCHA validation, including contact, comment, forum, invite, or signup workflows.
What does an attacker need to exploit this?
No authentication or user interaction is required. An attacker needs network access to the application and can submit a client-chosen form ID from a CAPTCHA-free form, such as login or search, together with data for a CAPTCHA-protected workflow.
What is the practical impact?
Attackers can bypass CAPTCHA-backed form validation and automate submissions to affected forms. This can enable abuse of contact, comment, forum, invite, and signup functionality.
How can I tell whether my instance is vulnerable?
Check the installed pH7Builder version: versions earlier than 19.3.0 are affected. A vulnerable behavior is present if a CAPTCHA-protected form accepts a submitted form ID chosen from a CAPTCHA-free form and proceeds without CAPTCHA validation.