CVE-2026-92806

phpList versions before 3.6.17 contain a cross-site request forgery (CSRF) flaw (CWE-352) in the mass subscriber removal form handler, which fails to validate anti-CSRF tokens. An attacker can host a crafted web page and, when a logged-in phpList administrator visits it, silently trigger requests that delete and blacklist arbitrary subscriber addresses using the admin's authenticated session. The impact is loss of mailing-list integrity: victims' subscribers can be removed en masse and blacklisted, damaging list deliverability and requiring manual restoration. Any self-hosted phpList deployment running a version prior to 3.6.17 whose administrator browses other sites while logged in is affected. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so exploitation has not been confirmed.

What to do: Upgrade phpList to version 3.6.17 or later, which restores CSRF token validation on the mass subscriber removal handler. Until upgraded, administrators should avoid browsing untrusted websites while logged into the phpList admin interface, and log out when idle. Review the subscriber list and blacklist for unexplained removals or blacklisted addresses that could indicate abuse.