CSRF in Phplist Phplist3
CVE-2026-73482
phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logged-in super-administrator into loading a crafted URL (e.g., embedded as an image in an email) to delete any non-self administrator account.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (25.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 25.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Phplist Phplist3 — versions 0
Weakness classification (CWE)
References
- github.com/phpList/phplist3/issues/1117 (issue-tracking, technical-description, exploit)
- github.com/phpList/phplist3/releases/tag/v3.7.0-RC5 (release-notes)
- github.com/phpList/phplist3/pull/1121 (issue-tracking, patch)
- github.com/phpList/phplist3/commit/5159c3ed33a5674a8169472b50d146d97f630746 (patch)
- www.vulncheck.com/advisories/phplist-rc5-cross-site-request-forgery-via-admins-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-73482?
- CVE-2026-73482 is a high-severity vulnerability in Phplist Phplist3, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.1/10. Published 2026-08-13.
- How severe is CVE-2026-73482?
- High severity. CVSS v3 base score is 8.1 out of 10.