CVE-2026-107636: External Control of Assumed-Immutable Web Parameter in ph7software ph7builder
Description
pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart_order_id, or the PayPal custom field while paying a token amount, or submit uncompleted PayPal IPN payments, to gain the most expensive membership and its paid features.
CVSS v4.0
Score 7.1high
Affected software
ph7software
ph7builder
pkg:github/ph7software/pH7-Social-Dating-CMSRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-107636 describes a vulnerability in pH7Builder (pH7 Social Dating CMS) prior to version 18.5.1 where payment validation is insufficient. Registered users with low privileges can exploit this flaw by supplying manipulated client-controlled parameters (plan, amount, item_number, cart_order_id, PayPal custom field) or by submitting uncompleted PayPal IPN payments. This allows them to gain unauthorized access to the most expensive membership tiers and their paid features, bypassing intended payment verification controls.
Potential Impact
The vulnerability enables privilege escalation from low-privileged registered members to the highest membership tier, granting unauthorized access to paid features without proper payment. This undermines the integrity of the payment system and can result in revenue loss for operators of affected installations.
Mitigation Recommendations
A fix is available in pH7Builder version 18.5.1. Users should upgrade to version 18.5.1 or later to remediate this vulnerability. No additional mitigation guidance is provided in the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-08T14:05:59.689Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac7a6672cdf04f6561df63b
Added to database: 10/08/2026, 14:19:19 UTC
Last enriched: 10/08/2026, 14:35:16 UTC
Last updated: 10/08/2026, 20:36:58 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.