CVE-2026-37604: PH7Software pH7Builder vulnerability
pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote unauthenticated attacker can exploit it against the admin login endpoint. No trusted-proxy position is required because the application accepts client-IP headers directly from the request.
What does an attacker need to do to bypass the lockout?
The attacker sends a different X-Forwarded-For value with each login attempt. This causes the application to treat attempts as originating from different IP addresses, preventing the IP-based counter and lockout from applying.
Are installations affected by default?
Installations through 18.2.0 are affected when the admin login protection relies on the described IP-based attempt counter and lockout behavior. The vulnerable IP resolution accepts HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR without confirming that the request came through a trusted proxy.
How can I determine whether an instance is vulnerable?
Check whether the installed pH7Builder version is 18.2.0 or earlier and inspect _protected/framework/Ip/Ip.class.php. An affected implementation uses HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR to determine the client address without restricting those headers to requests received from trusted proxies.