PT-2026-110215 · Ph7Software · Ph7Builder
CVE-2026-108905
·
Published
2026-10-11
·
Updated
2026-10-11
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
pH7Builder versions prior to 18.6.0
Description
An issue exists in Tool.class.php where a hard-coded API key allows unauthenticated attackers to bypass API access checks. By spoofing the Host header to localhost and using the
private api key variable with the value dev772277, an attacker can retrieve sensitive member data, including emails, IP addresses, phone numbers, and bank account fields.Recommendations
Update pH7Builder to version 18.6.0 or later.
Fix
Using Hardcoded Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ph7Builder