CVE-2026-37604

Deferred Deferred - Pending Action

IP Spoofing Bypass in pH7Builder CMS

Publication date: 2026-09-22

Last updated on: 2026-10-05

Assigner: MITRE

Description

pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-10-05

Generated

2026-10-13

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-12

NVD

CVE-2026-37604

EUVD

EUVD-2026-84812

Affected Vendors & Products

Vendor	Product	Version / Range
ph7software	ph7builder	to 18.3.0 (exc)
ph7software	ph7builder	to 18.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability in pH7Builder allows an attacker to bypass the admin login brute-force protection by spoofing the client IP address. The application reads the IP from HTTP headers like X-Forwarded-For without verifying if the request comes from a trusted proxy. This lets an attacker reset the failed login attempt counter with each request, enabling unlimited password guessing attempts.

Detection Guidance

To detect this vulnerability, monitor admin login attempts in pH7Builder logs for repeated failures from the same IP address. Check if the HTTP_X_FORWARDED_FOR header is being used to track attempts. Look for patterns where the IP address changes with each request, which may indicate exploitation.

Impact Analysis

If you use pH7Builder versions up to 18.2.0, an attacker could exploit this to gain unauthorized access to your admin account by bypassing IP-based rate limiting. This could lead to data breaches, unauthorized modifications to your site, or complete takeover of your dating platform.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance failures, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade pH7Builder to version 18.3.0 or later to address the issue. If upgrading is not immediately possible, implement network-level rate limiting or IP-based throttling at the firewall or web server level. Disable or restrict access to the admin login page via IP whitelisting if feasible.

Hi! I’m here to help you understand CVE-2026-37604. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70