pH7Builder CVE-2026-37603

No special server configuration is required: exploitation targets the default pH7Builder administration login of pH7 Social Dating CMS through 19.2.0, where the CAPTCHA is only rendered after the captcha_admin_enabled flag has been set in the PHP session. The attacker must simply establish a new session (discard cookies and obtain a fresh session ID) before each login POST so the escalation flag is never persisted and the CAPTCHA form element is never built. The practical limiting factor is not the bypass itself - it is unauthenticated and low-complexity - but the outcome: it only enables unlimited password guessing, so a strong or non-guessable admin password, or an external WAF/network-level rate limiter in front of the admin panel, materially blunts real impact.

This is a moderate, credible priority rather than an inflated high-CVSS finding. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N) correctly reflects a remotely reachable, low-complexity, unauthenticated flaw, but the C:L/I:L/A:N impact is honest: the bug itself does not compromise data - it only removes the CAPTCHA-based rate limiting that protects the admin login, turning an otherwise-throttled panel into an unlimited brute-force target. Signals are internally consistent: SSVC lists Exploitation=poc (matching the cybermapgroup 'Admin Brute-Force Protection Bypass Chain' writeup) and Automatable=yes, which is plausible because the bypass is a simple fetch-fresh-session-per-attempt loop, but SSVC Technical Impact is only 'partial,' aligning with C:L/I:L. EPSS is low at 0.38% (31st percentile), and there is no CISA KEV listing, so despite public POC/technique material there is no evidence of widespread active exploitation. The real-world severity is heavily conditioned on downstream password strength: the flaw only matters if the admin account has a guessable credential, since it grants unlimited guessing rather than direct access. The CPE string (cpe:2.3:a:n/a:n/a) is junk and the EUVD affected-version list ('n/a n/a') is unusable - affected range comes only from the description ('through 19.2.0'), so version scoping should be verified against the vendor repo.

A remote unauthenticated attacker scripts the admin login flow so that before each password attempt it requests a fresh session (discarding any prior cookie), which means the captcha_admin_enabled escalation flag is never set and no CAPTCHA is ever rendered. The attacker then runs an unthrottled credential/dictionary attack against the pH7Builder admin panel until a weak admin password is found. A public technique writeup exists (cybermapgroup blog) and SSVC marks exploitation as POC and automatable=yes.