CVE-2026-108903 in pH7Builder
Summary
by MITRE • 10/11/2026
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in pH7Builder prior to version 19.3.0 represents a critical failure in the implementation of automated bot prevention mechanisms, specifically within the PHP Form Builder (PFBC) library integrated into the content management system. This flaw is categorized under CWE-841 as an Improper Enforcement of Behavioral Validation and aligns with MITRE ATT&CK technique T1592.003, which involves gathering victim host information to identify security controls such as CAPTCHAs for evasion purposes. The core issue stems from the design of the PFBC Form::isValid() method, which is responsible for verifying that a submitted form has passed its associated validation checks, including CAPTCHA verification in this context. In a secure implementation, the system should bind the validity check strictly to the specific instance or session of the form being processed, ensuring that only forms rendered and served by the server during the current interaction can be validated as legitimate submissions.
The technical flaw arises because the isValid() function accepts an arbitrary client-supplied form ID parameter without sufficiently validating whether this ID corresponds to a CAPTCHA-protected form currently active in the user's session or context. An unauthenticated attacker can exploit this by first loading public-facing forms that do not require CAPTCHA verification, such as login pages or search interfaces, which are typically designed for ease of access and thus lack strict anti-bot protections. By inspecting these forms, the attacker identifies their unique form identifiers. The attacker then constructs a malicious request targeting protected endpoints like contact forms, comment sections, forum posts, invitation requests, or user signups, but instead of submitting the correct ID associated with those specific protected forms, they inject the ID obtained from the unprotected CAPTCHA-free forms.
This manipulation effectively tricks the server-side validation logic into believing that the submission originated from a form instance where CAPTCHA verification was successfully completed, even though no such interaction occurred. Because the system relies on the provided identifier to look up the expected state of the form rather than verifying the cryptographic or session-based proof of human interaction directly tied to the specific action being performed, it erroneously marks the malicious submission as valid. This bypass allows automated scripts and bots to interact with sensitive endpoints without triggering rate limits, spam filters, or abuse detection systems that rely on CAPTCHA challenges.
The operational impact of this vulnerability is significant for any deployment using affected versions of pH7Builder. Attackers can automate high-volume actions such as creating fake user accounts through the signup form, which facilitates account takeover attacks, credential stuffing campaigns, and the creation of botnets within the platform's ecosystem. Similarly, automated submissions to contact forms or comment sections enable widespread spam distribution, phishing link injection, and reputation damage for site administrators. Forum abuse can lead to misinformation spread and community degradation, while unauthorized invitations sent via invite mechanisms can be used for social engineering attacks against legitimate users. The lack of CAPTCHA enforcement on these critical interaction points removes a primary layer of defense against automated abuse tools like Selenium or custom Python scripts.
To mitigate this vulnerability, administrators must upgrade pH7Builder to version 19.3.0 or later, where the PFBC library has been patched to enforce stricter validation rules that prevent ID spoofing and ensure CAPTCHA tokens are correctly bound to their respective form instances. In environments where immediate patching is not feasible, temporary mitigations include implementing server-side rate limiting based on IP addresses for sensitive endpoints like signup and contact forms to reduce the efficacy of automated attacks. Additionally, deploying a Web Application Firewall with rules that detect anomalous patterns in form submission headers or IDs can help block exploitation attempts. It is also advisable to review custom integrations of PFBC within the application codebase to ensure no other instances exist where form identifiers are passed directly from client-side inputs without rigorous server-side validation against session state and CAPTCHA token integrity checks.