phpList before version 3.7.0-RC5 does not enforce CSRF token validation on the bounce rule deletion endpoints (bouncerules.php / bouncerule.php). The deletion action is performed through a GET request with a 'del' parameter, and the CSRF check function (verifyCsrfGetToken) is called with enforcement disabled unless a 'tk' parameter is present. This design flaw allows a remote attacker to craft a URL that, when visited by an authenticated administrator, can delete arbitrary bounce rules from the phplist_bounceregex database table without requiring a valid CSRF token.

An attacker can cause an authenticated administrator to unknowingly delete bounce rules by tricking them into loading a malicious URL. This could disrupt email bounce handling by removing rules that manage bounced emails, potentially affecting email campaign effectiveness and system behavior. There is no indication of privilege escalation or data disclosure beyond the deletion of bounce rules.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while authenticated in phpList and consider additional protective measures such as restricting access to the bounce rule management interface or implementing web application firewall rules to detect and block suspicious requests targeting these endpoints.