phpList before version 3.7.0-RC5 does not enforce CSRF token validation on the bounce rule deletion endpoints (bouncerules.php / bouncerule.php). The deletion action is performed via a GET request with a 'del' parameter, and the central CSRF check function (verifyCsrfGetToken) is called with enforcement disabled (enforce=false). This means the CSRF token is only validated if a 'tk' parameter is present, which is not required for the deletion request. Consequently, a remote attacker can craft a URL that, when loaded by an authenticated administrator (e.g., embedded in an image tag), causes arbitrary bounce rules to be deleted from the phplist_bounceregex table without a valid CSRF token.

An attacker can cause an authenticated administrator to unknowingly delete arbitrary bounce rules in phpList, potentially disrupting email bounce handling and affecting mailing list management. This could lead to denial of service or mismanagement of bounce rules. The vulnerability requires the attacker to trick an authenticated admin into loading a malicious URL, but no privileges beyond administrator access are needed to exploit it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while authenticated in phpList. Implementing additional CSRF protections or restricting access to the affected endpoints may help mitigate risk.