CVE-2026-92806 [HIGH] – phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the m

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.