EUVD-2026-95023
GHSA-32w5-672c-jvph
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated member can tamper trusted payment parameters remotely (PR:L, AV:N, AC:L, UI:N); impact is integrity-only membership escalation (I:H), with no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart_order_id, or the PayPal custom field while paying a token amount, or submit uncompleted PayPal IPN payments, to gain the most expensive membership and its paid features.
Articles & Coverage 1
AnalysisAI
An authenticated low-privileged member of a pH7Builder (pH7 Social Dating CMS) site running a version before 18.5.1 can upgrade themselves to the most expensive paid membership tier without paying the corresponding price. The payment controller trusts client-supplied plan and amount parameters - specifically item_number, cart_order_id, and the PayPal 'custom' field - so an attacker can pay a token amount (or submit an uncompleted PayPal IPN notification) and still be granted the highest tier and all of its paid features. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated low-privileged member account (PR:L) on a pH7Builder instance older than 18.5.1 with the payment module and a gateway (notably PayPal) enabled for paid memberships. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded business-logic flaw rather than a mass-exploitation emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to pH7Builder 18.5.1 or later, which is the vendor-released fix containing commit 5218d017491fc855c0c788bd020e2376efdee76e and the server-side checkout token, session-backed checkout context, isPurchasableMembership() gating, and server-computed pricing. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all pH7Builder (pH7 Social Dating CMS) instances and identify any running versions before 18.5.1; Vendor-released patch: 18.5.1, so prioritize patching instances that sell paid tiers through enabled gateways such as PayPal, and if immediate patching is not feasible, temporarily disable paid-upgrade/payment gateway functionality or restrict membership tier changes to manual review while reviewing payment and IPN logs for suspicious tier upgrades. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today