CVE-2026-108903: pH7Builder CAPTCHA Bypass Vulnerability

CVE-2026-108903 Overview

CVE-2026-108903 is a CAPTCHA bypass vulnerability in pH7Builder (pH7 Social Dating CMS) before version 19.3.0. The flaw resides in how the application invokes PFBC\Form::isValid(), trusting a form identifier supplied in the request body rather than a server-side constant. Unauthenticated attackers can load a CAPTCHA-free form such as login or search, then replay its ID when submitting contact, comment, forum, invite, or signup data. This defeats the CAPTCHA control and enables automated abuse of user-facing forms. The weakness is classified under CWE-807: Reliance on Untrusted Inputs in a Security Decision.

Critical Impact

Unauthenticated attackers can automate submissions to any CAPTCHA-protected form, enabling spam, phishing, account creation abuse, and content flooding at scale.

Affected Products

• pH7Builder (pH7 Social Dating CMS) versions prior to 19.3.0
• Deployments using the vendored PFBC form library with the vulnerable validation pattern
• Public-facing instances exposing contact, comment, forum, invite, or signup forms

Discovery Timeline

• 2026-10-11 - CVE-2026-108903 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108903

Vulnerability Analysis

The vulnerability stems from how pH7Builder validates form submissions. Each form handler checks PFBC\Form::isValid($_POST['submit_xxx']), passing the attacker-controlled POST key as the form identifier. The isValid() method retrieves CAPTCHA state keyed to that identifier, so an attacker who submits a form ID that was never CAPTCHA-protected passes validation on a different form entirely.

An attacker fetches a page containing a CAPTCHA-free form (for example, the login or search form), obtains its ID, then issues a POST to the contact, comment, forum, invite, or signup endpoint while providing the harmless form's ID. The validation routine confirms the ID is valid in session and permits the submission, skipping the CAPTCHA that would otherwise rate-limit or block the request.

Impact is limited to integrity of form-processing workflows. There is no direct code execution, data disclosure, or availability loss, but the bypass enables automated spam, scraping, and bulk account creation.

Root Cause

The root cause is a security decision made on untrusted input [CWE-807]. The form identifier used to look up CAPTCHA validation state is sourced from the request body instead of a server-controlled constant tied to the specific handler. Any valid session-registered form ID satisfies the check, regardless of whether the originating form required a CAPTCHA.

Attack Vector

Exploitation requires only network access to a vulnerable instance and no authentication or user interaction. An attacker performs the following steps:

1. Request a page hosting a CAPTCHA-free form (such as /login or /search) and extract its form ID from the HTML.
2. Craft a POST request to a CAPTCHA-protected endpoint (contact, comment, forum, invite, or signup) carrying the harvested form ID.
3. Submit arbitrary payload data, which the server processes after PFBC\Form::isValid() incorrectly returns true.

The upstream commit 4758d7d demonstrates the fix pattern applied to each affected form handler:

    public static function display()
    {
        if (isset($_POST['submit_change_password'])) {
-           if (\PFBC\Form::isValid($_POST['submit_change_password'])) {
+           if (\PFBC\Form::isValid('form_change_password')) {
                new ChangePasswordCoreFormProcess();
            }

Source: GitHub Commit 4758d7d

A parallel fix in ConfigFileCoreForm.php replaces the request-derived identifier with the static string 'form_config':

        if (isset($_POST['submit_config'])) {
-           if (\PFBC\Form::isValid($_POST['submit_config'])) {
+           if (\PFBC\Form::isValid('form_config')) {
                new ConfigFileCoreFormProcess($sConfigVar, $sIniFile);
            }

Source: GitHub Commit 4758d7d

Detection Methods for CVE-2026-108903

Indicators of Compromise

• Spikes in contact, comment, forum, invite, or signup submissions that lack preceding GET requests to the matching form page.
• POST requests to CAPTCHA-protected endpoints carrying form identifiers associated with other pages (for example, submit_login or submit_search keys appearing in signup requests).
• Repeated submissions from the same source IP or user agent that bypass CAPTCHA challenge issuance.

Detection Strategies

• Correlate web server access logs to identify POST bodies containing form IDs that do not match the targeted endpoint's expected form.
• Add server-side logging in PFBC\Form::isValid() to record the submitted form ID alongside the handler path, flagging mismatches.
• Baseline normal form-submission rates and alert on sudden deviations suggesting automated abuse.

Monitoring Recommendations

• Monitor outbound mail queues and database insert rates for comment, contact, and invite tables for anomalous volume.
• Track account registration cadence and flag bursts of signups from narrow IP ranges or ASN clusters.
• Review WAF telemetry for repeated POSTs lacking a prior CAPTCHA token issuance event.

How to Mitigate CVE-2026-108903

Immediate Actions Required

• Upgrade pH7Builder to version 19.3.0 or later, which applies the server-side form ID fix across all affected handlers.
• Audit any custom modules that call PFBC\Form::isValid() and replace request-derived identifiers with hard-coded form names.
• Rotate or clear any abusive user-generated content, spam accounts, or forum posts created during the exposure window.

Patch Information

The vendor fix is published in commit 4758d7d and shipped in pH7Builder 19.3.0. The patch replaces every \PFBC\Form::isValid($_POST['submit_xxx']) call with a static form identifier such as \PFBC\Form::isValid('form_change_password'), ensuring the CAPTCHA state lookup matches the handler being executed. See the VulnCheck Advisory for pH7Builder for additional context.

Workarounds

• Deploy a Web Application Firewall rule that rejects POSTs to contact, comment, forum, invite, and signup endpoints when the body contains unexpected submit_* keys.
• Introduce an upstream rate limit on form endpoints to blunt automated abuse until the upgrade is deployed.
• Temporarily disable public-facing comment, invite, and signup forms on instances that cannot be patched promptly.

# Upgrade pH7Builder to the patched release
git fetch --tags
git checkout v19.3.0
# Verify the fix is present in affected form handlers
grep -R "PFBC\\\\Form::isValid(\$_POST" _protected/app/system/
# Expected: no matches in version 19.3.0 or later