CVE-2026-108903

Name of the Vulnerable Software and Affected Versions pH7Builder versions prior to 19.3.0

Description An issue exists that allows unauthenticated attackers to bypass CAPTCHA validation. By providing a client-chosen form ID to the isValid() function within the PFBC Form class, attackers can skip required form validation. This is achieved by loading a form that does not require CAPTCHA, such as login or search, and submitting its ID along with data for contact, comment, forum, invite, or signup forms to automate abuse.

Recommendations Update to version 19.3.0 or later.