PhpList (< 3.6.17) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/phplist--3.6.17/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 21:58:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCSRF Vulnerability in phpList Mass Subscriber Removalhttps://feed.craftedsignal.io/briefs/2026-09-phplist-csrf/Wed, 16 Sep 2026 21:58:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-phplist-csrf/phpList versions prior to 3.6.17 are vulnerable to CSRF, allowing an attacker to force an authenticated administrator to delete or blacklist subscribers without authorization.phpList versions before 3.6.17 contain a vulnerability in the mass subscriber removal form handler, where the application fails to properly validate cross-site request forgery (CSRF) tokens. This security flaw enables a remote, unauthenticated attacker to induce an already logged-in administrator to perform unauthorized actions by visiting a specially crafted malicious webpage. Upon the administrator's interaction with this page, the application processes the removal and blacklisting of arbitrary subscriber addresses silently and without further authentication or validation prompts. This issue poses a significant risk to subscriber list integrity, potentially resulting in mass data loss or administrative disruption within marketing campaigns. Organizations utilizing affected versions of phpList should prioritize upgrading to version 3.6.17 or later to address the missing token validation mechanism.

Impact

Successful exploitation results in the unauthorized deletion and permanent blacklisting of subscriber records. This can lead to the loss of entire mailing list segments, disruption of legitimate marketing activities, and administrative burden to recover subscriber data. The vulnerability is particularly severe for organizations relying on phpList for time-sensitive or critical communication.

Recommendation

  • Upgrade all instances of phpList to version 3.6.17 or later immediately to patch CVE-2026-92806.
  • Audit access logs for suspicious administrative activity occurring during off-hours or from anomalous IP addresses to identify potential prior abuse.
  • Implement strict Content Security Policy (CSP) headers on administrative dashboards to mitigate the impact of malicious cross-site scripting or redirection attempts.
]]>highadvisoryweb-vulnerabilitycsrfpatch-management