phpList CVE-2026-73482

Three specific conditions must hold simultaneously: (1) The victim must be a super-administrator - not a standard administrator - with an active authenticated phpList session open in the same browser at the time the crafted URL is loaded; only super-administrators are authorized to perform admin deletion in phpList, so lower-privilege session compromise does not suffice. (2) The attacker must know or successfully enumerate the numeric database ID (N) of the target administrator account in the ?page=admins&delete=N parameter. (3) The phpList admin interface must be reachable from the network path taken by the victim's browser when the email is opened - typically internet-accessible instances or those on a shared network with the administrator. No non-default configuration is required to be vulnerable; the enforce=false behavior in verifyCsrfGetToken is the default code path, meaning all unpatched phpList3 installations are affected by design. Exploitation is limited by the super-administrator session requirement and the need for numeric admin ID knowledge, but neither constitutes a high barrier given that admin IDs are sequential integers.

The CVSS 4.0 base score of 7.2 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H) reflects a network-exploitable flaw with no complexity or privilege prerequisites for the attacker, tempered by a passive user-interaction requirement - the super-administrator must load or render the crafted URL. The integrity and availability impacts on the vulnerable system are both High, capturing the ability to delete administrator accounts and potentially lock out management capability entirely. EPSS data was not supplied in the source intelligence, so exploitation probability cannot be quantified. Public exploit availability confirmed by VulnCheck meaningfully elevates practical risk above what the 7.2 score alone conveys, because the attack requires no specialized tooling - a single crafted URL suffices. Despite the UI:P dependency, delivery via HTML email image embedding is a low-friction and routine social-engineering vector, meaning even a mid-sized municipal IT team in gliwice running phpList for community newsletters should treat this as urgent remediation rather than a deferred backlog item. No CISA KEV listing is present, and exploitation appears opportunistic rather than targeted; however, the combination of a simple attack path, public exploit, and a privileged impact (super-admin session required on victim side) makes this a real operational priority for any phpList operator.

An attacker identifies a publicly accessible phpList installation and enumerates or guesses a target administrator's numeric account ID. The attacker embeds a crafted image tag - such as an img element pointing to https://target.example.com/lists/admin/?page=admins&delete=3 - in an HTML email sent to a known super-administrator. When the super-administrator opens the email while holding an active phpList session, the browser silently issues the GET request with the existing session cookie, deleting the targeted administrator account with no visible interaction. A publicly available proof-of-concept is referenced in the GitHub issue at https://github.com/phpList/phplist3/issues/1117.