Which versions of pH7Builder are affected by EUVD-2026-95025?

pH7Builder deployments below version 18.5.0 are exposed to a two-factor authentication bypass that, when an attacker already holds a valid account password, can lead to takeover of member, affiliate,…. A patch is available.

How to fix or mitigate EUVD-2026-95025?

Vendor-released patch: 18.5.0. Within 24 hours, inventory all pH7Builder instances and confirm whether any run versions earlier than 18.5.0; immediately upgrade those systems to 18.5.0, prioritizing internet-facing and administrator-enabled deployments. Within 7 days, apply the 18.5.0 update across all remaining instances, verify that the reused per-IP login-attempt lockout now throttles VerificationCodeFormProcess.php submissions, and review authentication logs for repeated failed TOTP attempts or suspicious account activity, resetting credentials for any affected accounts. Within 30 days, validate that every instance is on 18.5.0 or later, incorporate this version check into routine patch management, and review 2FA and account recovery processes to ensure brute-force protections are consistently enforced.

pH7Builder EUVD-2026-95025

Q: What is the CVSS score of EUVD-2026-95025?

EUVD-2026-95025 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

| CVE-2026-107638 HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-10-08 VulnCheck

GHSA-grjj-qrfp-h6h9

PHP Authentication Bypass Ph7Builder

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Attacker must know the password (PR:L) but then faces no lockout, making brute force reliable (AC:L); network-reachable form (AV:N), no UI, and account takeover yields C:H/I:H with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 14:53 vuln.today

CVE Published

Oct 08, 2026 - 14:10 cve.org

HIGH 7.6

DescriptionCVE.org

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts.

Articles & Coverage 1

News 10 New PHP Vulnerabilities - 3 Critical, 7 High Severity Patched Oct 09, 2026

AnalysisAI

Two-factor authentication bypass in pH7Builder (pH7 Social Dating CMS) before 18.5.0 lets attackers who already know a valid account password brute-force the 6-digit TOTP code submitted to VerificationCodeFormProcess.php without any attempt throttling, ultimately taking over member, affiliate, or administrator accounts. Exploitation is second-order: it requires prior credential compromise (PR:L) plus 2FA enabled on the target account, and success depends on racing the OTP rotation window (AT:P), but when those conditions hold nothing stops unlimited guesses. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires (1) the attacker already knowing the target account's password, and (2) the target account having two-factor authentication enabled, so the attacker reaches the TOTP verification step handled by VerificationCodeFormProcess.php. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a legitimately exploitable authentication weakness but a second-order one, not a drive-by. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to pH7Builder 18.5.0, which adds per-IP login-attempt lockout to the TOTP verification flow; the exact fix is commit 44970860b82f8af867de9d2832081485f5dbe578 (https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/44970860b82f8af867de9d2832081485f5dbe578) and the vendor advisory is at https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-2fa-brute-force-via-verificationcodeformprocess-php. … Detailed patch versions, workarounds, and compensating controls in full report.