phpList versions prior to 3.7.0-RC5 allow an attacker to delete any administrator account that is not the attacker’s own super‑administrator account through a cross‑site request forgery (CSRF) flaw. The deletion action is triggered by an unauthenticated GET request to admins.php with a delete parameter that is not protected by a CSRF token. This flaw can compromise the integrity of the system by removing administrative privileges that are essential for managing mailing lists, potentially leading to loss of control over the application and exposed content.

The vulnerability affects all installations of phpList 3.x running any release before the 3.7.0-RC5 release. The insecure admins.php deletion operation is present across all these affected versions, with no further version nuance indicated in the CNA data.

The flaw carries a CVSS score of 7.2, indicating a high severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified, but the absence of EPSS does not imply an absence of risk. The vulnerability is not listed in CISA’s KEV catalog, yet an attacker can potentially exploit it by embedding a crafted URL (for example, in an email or a web page) that forces a logged‑in super‑administrator to load the deletion request. Once the delete action is executed, the targeted administrator account is removed, reducing the administrative capacity of the system.