pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trus…

Exploitation

poc

Automatable

yes

Technical impact

partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

1. Sep 22, 2026Published

   Disclosed via NVD

2. Sep 23, 2026EPSS first tracked

   0.3%

3. Sep 23, 2026CVSS changed

   — → 9.8

4. Sep 23, 2026Severity changed

   none → critical

5. Sep 25, 2026EPSS peak

   0.3% → 0.7%

6. Oct 5, 2026Record revised

   Last analysed / modified upstream

7. Oct 5, 2026Public exploit observed

   Exploit / PoC code exists

8. Oct 5, 2026CVSS changed

   9.8 → 6.5

9. Oct 5, 2026Severity changed

   critical → medium

Change history

Field changes observed since this record was first indexed.

• Oct 5, 2026Public exploit / PoC published
• Oct 5, 2026CVSS 9.8 → 6.5
• Oct 5, 2026Severity critical → medium
• Sep 23, 2026CVSS — → 9.8
• Sep 23, 2026Severity none → critical