CVE-2026-107636
pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart_order_id, or the PayPal custom field while paying a token amount, or submit uncompleted PayPal IPN payments, to gain the most expensive membership and its paid features.
| CWE | CWE-472 |
| Vendor | ph7software |
| Product | ph7builder |
| Published | Oct 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for ph7software ph7builder
Be the first to know when new medium vulnerabilities affecting ph7software ph7builder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
ph7software / ph7builder
0 < 18.5.1
References
github.com: https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/5218d017491fc855c0c788bd020e2376efdee76e github.com: https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.5.0/_protected/app/system/modules/payment/controllers/MainController.php#L274-L380 github.com: https://github.com/pH7Software/pH7-Social-Dating-CMS vulncheck.com: https://www.vulncheck.com/advisories/ph7builder-before-18.5.1-payment-bypass-via-payment-module-maincontroller
Credits
Haluk Baran AKBULUT (CyberMap Group)