CVE-2026-108905: Use of Hard-coded Credentials in ph7software ph7builder

CVE-2026-108905 describes a vulnerability in pH7Builder (pH7 Social Dating CMS) prior to version 18.6.0 where a hard-coded API key in Tool.class.php enables unauthenticated attackers to bypass API access checks. By sending a Host header set to 'localhost' along with the private_api_key parameter set to 'dev772277' and the default allowed URL, attackers can access sensitive user data such as member emails, IP addresses, phone numbers, and bank account fields. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity, with no privileges or user interaction required for exploitation.

Successful exploitation allows unauthenticated attackers to bypass API authentication and access sensitive personal and financial information of members, including emails, IP addresses, phone numbers, and bank account details. This exposure can lead to privacy violations and potential financial fraud.

A fixed version 18.6.0 or later is available that addresses this vulnerability. Users should upgrade to version 18.6.0 or newer to remediate this issue. No vendor advisory or patch link was provided, but the affected version range indicates the fix is included starting from 18.6.0.