CVE-2026-73481

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is performed via a GET request (?page=bouncerules&del=N), and the central CSRF check (verifyCsrfGetToken) is invoked with enforce=false, so it only validates the token when a 'tk' parameter is present. A remote attacker can trick an authenticated administrator into loading a crafted URL (e.g., embedded in an image tag) to delete arbitrary bounce rules from the phplist_bounceregex table without a valid CSRF token.

We have discovered 1,198 live websites that are affected by CVE-2026-73481.

Run a Free Instant Scan

Affected Software

Product	phpList
Category	Email Marketing
Vulnerable Domains	1,198 live websites (100% of phpList install base)
Vulnerable Versions	from 0 through 3.7
Vulnerable Versions Count	64 versions ( 100% of all versions)