CVE-2013-7305: fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers...

Security readout for executives and security teams

This issue affects e107 through 1.0.4. A banned user's account could still go through password reset if someone controls that user's email account. The business risk is account reactivation or takeover of banned accounts, but the source bundle gives no CVSS score and no evidence of active exploitation. Exposure is likely limited to sites running e107 through 1.0.4 with password reset enabled and banned accounts still tied to reachable email addresses. The bundle's structured affected-product fields are incomplete, so version confirmation is necessary. Treat this as a targeted account-control weakness, not a confirmed mass-exploitation event. Prioritize if e107 is internet-facing, legacy, or has many banned accounts. Evidence is incomplete, so validation should precede emergency action. Mitigation focus: Inventory any e107 installations and confirm whether they are through version 1.0.4.; Check e107 vendor guidance and the referenced SourceForge revision for the appropriate fix.; Upgrade or patch affected e107 deployments according to confirmed vendor guidance..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.