Is CVE-2026-92806 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92806?

CVE-2026-92806 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-92806

Description

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.