pH7Builder CVE-2026-37604

Exploitation requires that the target run pH7Builder (pH7 Social Dating CMS) at or below version 18.2.0 with the IP-based admin login lockout/throttling active - the very control being bypassed. The attacker needs only network reachability to the admin login endpoint and the ability to set the HTTP_CLIENT_IP or X-Forwarded-For request header (trivial with any HTTP client); no authentication or user interaction is needed. The practical limiting factor is that the flaw only defeats brute-force protection: actual admin compromise still depends on guessing valid credentials (weak or default admin passwords), so deployments with strong passwords or MFA face reduced real-world risk. The application must also not be behind a correctly-configured reverse proxy that strips/overwrites these client headers before they reach the app.

The input assigns a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H), but this rating substantially overstates the direct impact. The vulnerability itself is a bypass of an anti-brute-force security control: because pH7Builder trusts client-supplied HTTP_CLIENT_IP / X-Forwarded-For headers without validating a trusted proxy, an attacker rotates the header value per request to evade the per-IP admin login lockout. That does NOT by itself yield code execution or data disclosure - it removes the rate limit protecting the admin login, enabling unlimited credential guessing. The high C:H/I:H/A:H triad reflects the downstream consequence of a successful brute-force (full admin takeover), not the flaw in isolation, so the 9.8 is best read as worst-case. Supporting signals are modest: EPSS is low at 0.34% (27th percentile), SSVC records Exploitation=none (no observed exploitation) though Automatable=yes and Technical Impact=total. There is no CISA KEV listing and no confirmed public exploit code flagged in the input (a third-party blog describes the bypass chain as analysis). Net: this is a real, easily-automatable weakness worth patching, but it is a brute-force enabler in a niche product, not a directly-critical RCE - treat it as medium priority rather than a drop-everything emergency. Note the CWE-444 (request smuggling) classification is a poor fit; the mechanism is untrusted-proxy IP spoofing (closer to CWE-290/CWE-348).

A remote unauthenticated attacker targets the pH7Builder admin login and scripts a credential brute-force, sending a unique X-Forwarded-For (or HTTP_CLIENT_IP) header on every request so each attempt appears to originate from a fresh IP and never trips the per-IP lockout counter. This lets them run an unbounded password-guessing campaign against the admin panel; no public exploit is flagged in the input, but a third-party blog documents the full bypass chain, and SSVC marks it Automatable=yes.