CVE-2026-92806
phpList before 3.6.17 Cross-Site Request Forgery via massremove.php
CVSS 4.0 7.2 HIGHCVSS 3.1 8.1 HIGHCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-92806
PublishedphpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-92806 · CVE overview and exploitation status
cve-program · CVE-2026-92806
- https://github.com/geo-chen/oss/blob/main/phplist3.md
- https://github.com/phpList/phplist3/blob/v3.6.16/public_html/lists/admin/massremove.php#L13-L24
- https://github.com/phpList/phplist3/blob/v3.6.17/public_html/lists/admin/massremove.php#L10
- https://github.com/phpList/phplist3
- https://www.vulncheck.com/advisories/phplist-before-3.6.17-cross-site-request-forgery-via-massremove-php
Related changes
Linked by CVE identifierNo related changes are available here.