pH7Builder CVE-2026-108905

Exploitation requires that the pH7Builder API (framework/Api/Tool.class.php) be network-reachable and that the application's 'default allowed URL' be in place - which is the shipped default, since the authorization relies on a hard-coded key (dev772277) baked into the code. The attacker must supply a forged 'Host: localhost' header together with that static key, so the only real prerequisite is reaching the API endpoint over the network; no authentication, user interaction, or non-default configuration is needed (AV:N/AC:L/PR:N/UI:N). The practical limiting factors are therefore deployment-dependent: the API endpoint must be exposed to the attacker, the installation must be a version before 18.6.0 that still contains the hard-coded key, and any upstream proxy or WAF that normalizes or validates the Host header could blunt the spoofing step.

This is a genuine, high-priority confidentiality exposure that the raw signals understate rather than inflate. The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes a network-reachable, low-complexity, unauthenticated flaw with high impact to the vulnerable system's confidentiality, scoring 8.7 (High) - and the CWE-798 (hard-coded credentials) classification plus the concrete description align cleanly with that vector, so there is no contradiction between the metrics and the narrative. The attack is trivially repeatable because the bypass relies on a static, publicly-known key (dev772277) combined with a forgeable Host header, which is exactly the kind of deterministic condition that favors reliable exploitation. However, EPSS is not provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active exploitation - the elevated risk is driven by ease of exploitation and sensitivity of exposed data (emails, IPs, phone numbers, bank account fields), not by observed attacks. The one signal tempering real-world urgency is deployment footprint: pH7Builder is a niche open-source dating CMS, so this is a serious issue for the installed base but not a mass-exploitation candidate across typical enterprise environments. Net: a real priority for anyone running pH7Builder, but a low-prevalence product rather than an internet-wide emergency.

A remote attacker sends an HTTP request to the pH7Builder API endpoint with a spoofed 'Host: localhost' header, the hard-coded private_api_key=dev772277, and the default allowed URL, causing the Tool.class.php access check to treat the request as a trusted local/internal caller. With the bypass successful, the attacker queries member records and harvests emails, IP addresses, phone numbers, and bank account fields without any credentials. No public exploit is identified at time of analysis, but the low-complexity, unauthenticated network vector (AV:N/AC:L/PR:N/UI:N) makes reliable reproduction straightforward once the static key is known.