Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108905pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

High 7.5

In plain English

A high-severity hard-coded credentials in ph7builder from ph7software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 76.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.

Affected products (as reported)

Vendor	Product	Versions
ph7software	ph7builder	0 – before 18.6.0

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Patch Commit patch
https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.5.1/_protected/framework/Api/Tool.class.php#L25-L48 technical-description
https://github.com/pH7Software/pH7-Social-Dating-CMS product
VulnCheck Advisory: pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header third-party-advisory