CSRF Vulnerability in phpList Product by phpList
CVE-2026-73481
Key Information:
Badges
What is CVE-2026-73481?
The affected versions of phpList fail to adequately enforce CSRF token validation on the bounce rule deletion endpoint. Specifically, the vulnerability allows an attacker to delete arbitrary bounce rules from the database by tricking an authenticated administrator into triggering a crafted GET request without a proper CSRF token. This can be executed via various means, such as embedding malicious scripts in content that an administrator may access. This serious oversight can compromise the integrity of the phpList application and lead to unauthorized data manipulations, highlighting the importance of secure token validation practices.
Affected Version(s)
phplist3 0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved