phpList 3 CVE-2026-73481

The victim must be an authenticated phpList administrator with an active session cookie in their browser at the time they load the attacker-controlled resource. The attacker must know or enumerate the numeric ID (del=N) of the bounce rule to target; with no ID knowledge an attacker could iterate small integers to delete all rules. No special server-side configuration is required beyond a default phpList 3 installation prior to RC5 - the vulnerable code path is enabled by default. Exploitation is limited to the scope of bounce rule deletion only; it does not provide shell access, credential disclosure, or privilege escalation. Blind deletion (without confirmation of effect) is the primary limiting factor, as is the social-engineering step required to cause the administrator to load the crafted URL.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L) scores 5.3, reflecting limited integrity and availability impact constrained by the UI:P requirement - the attacker must cause an authenticated administrator to trigger the request. The attack complexity is genuinely low: a single image tag or hyperlink suffices for delivery. There is no confidentiality impact, and the blast radius is limited to deletion of bounce rule records, which affects automated email bounce processing rather than account compromise or data exfiltration. The EPSS score is not supplied, but the combination of a public POC on GitHub, a straightforward CSRF delivery mechanism, and a popular open-source application suggests moderate real-world exploitation risk against unpatched installations that have active administrators browsing attacker-influenced content. The absence of CISA KEV listing means confirmed mass exploitation is not yet observed. The primary risk is disruption to bounce management configuration, which could cause a phpList instance to lose tuned deliverability controls - a meaningful operational impact for high-volume mail operators but not a critical data-breach vector.

An attacker identifies a phpList deployment and crafts a URL such as https://target.example.com/lists/admin/?page=bouncerules&del=5 targeting a known or guessed bounce rule ID. The attacker embeds this URL as the src of an invisible img tag in a phishing email or a web forum post and sends it to a phpList administrator. When the administrator's browser renders the page while the administrator is logged into the phpList admin interface, the browser issues the GET request with the administrator's session cookie, causing the bounce rule to be silently deleted without any CSRF token. A publicly available proof-of-concept is referenced in GitHub issue #1116, demonstrating the delivery technique.