The flaw occurs in the administration login of pH7Builder, where the CAPTCHA escalation flag is stored only in the PHP session under the key captcha_admin_enabled. When this flag is missing, the login form omits the CAPTCHA element, allowing a remote attacker to re‑initialize a new session before each attempt and thus bypass the intended lockout. This permits an unauthenticated attacker to try administrator credentials without restriction, potentially compromising confidentiality, integrity, and availability of the CMS. The weakness is classified as CWE‑307.

Installs of pH7Software’s pH7Builder (pH7 Social Dating CMS) running version 19.2.0 or earlier. The vulnerability only appears in the administrative login path and requires no special privilege beyond web access to the login endpoint.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% implies a modest likelihood of exploitation. This vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker can create a new session before each login attempt, thereby avoiding the CAPTCHA challenge. The absence of enforced lockout or rate limiting means an attacker may exhaust password possibilities, potentially acquiring administrative control; however, success depends on credential strength and the low EPSS score suggests exploitation is currently unlikely unless weak or default passwords are used.