Description

pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-11T15:16:56.490Z",
  "pubdate": "2026-10-11T15:16:56.490Z",
  "executiveSummary": "pH7Builder, a social dating CMS, is susceptible to a CAPTCHA bypass vulnerability due to insecure form validation logic. This flaw permits unauthenticated attackers to circumvent security verification mechanisms during form submissions.\nBy manipulating the form identifier submitted to the application's backend, an attacker can effectively neutralize the CAPTCHA requirement for sensitive operations. The vulnerability stems from the implementation of PFBC Form::isValid(), which fails to adequately validate the binding between the requested form action and its associated security requirements.\nThe risk implication is significant, as it enables the automation of malicious activities, including mass registration, spamming of contact forms, and unauthorized forum posting. Exploitation requires no prior authentication, lowering the barrier for entry for remote attackers. Any installation of pH7Builder prior to version 19.3.0 is considered vulnerable. Organizations relying on this CMS for user engagement or registration should prioritize upgrading to the patched version to restore form integrity and prevent automated abuse.",
  "technicalDetails": "The vulnerability resides within the PFBC (PHP Form Builder Class) integration used by pH7Builder. The core issue is an improper validation logic within the PFBC Form::isValid() function, which relies on the client-supplied form ID to determine whether the form submission should be subjected to CAPTCHA verification.\nThe attack flow begins when an attacker identifies the structure of a protected form, such as the signup, contact, or invite forms. Because the application logic trusts the form ID provided by the client, an attacker can load a legitimate, unprotected form (e.g., a search form or a login form that may have a different security context) to obtain a valid form session or identifier. Subsequently, the attacker crafts a malicious POST request targeting the protected endpoint (e.g., the signup or contact form processor).\nIn the crafted request, the attacker substitutes the required form ID with the identifier of the CAPTCHA-free form they previously accessed. When the backend logic invokes PFBC Form::isValid(), the function processes the user-supplied ID rather than validating the context of the specific form submission. Consequently, the backend logic incorrectly assumes the current request is associated with a form that does not require CAPTCHA validation, allowing the request to proceed without the verification step.\nThis flaw allows an attacker to bypass all server-side validation checks intended to prevent automated interactions. By leveraging this method, attackers can mass-submit data to restricted forms, which significantly impacts the integrity of user data and server resources. The attack is executable via standard HTTP request manipulation tools, such as Burp Suite or cURL, and does not require elevated privileges or local network access. The vulnerability persists in versions of pH7Builder prior to 19.3.0, representing a failure to enforce strict security state binding between the server-side form definition and the incoming request payload."
}