CVE-2026-85602: Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass
The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 field name (g-recaptcha-response instead of token), causing validation to use the v2 branch, which never applies the score threshold or verifies the expected action. This results in a complete bypass of reCAPTCHA v3 bot protection. The issue is fixed in version 9.1.20.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-formto a version that resolves this vulnerability.Fixed in 9.1.20
Event History
Frequently Asked Questions
Which deployments are affected?
Grav Form plugin versions 8.0.6 through 9.1.19 are affected when the site is configured to use reCAPTCHA v3. The issue affects forms whose bot protection relies on v3 score-threshold and expected-action validation.
What does an attacker need to exploit this issue?
An attacker can exploit it anonymously over the network by submitting a form payload that places a reCAPTCHA v3 token in the g-recaptcha-response field instead of the token field. No authentication or user interaction is required.
What validation is bypassed?
The manipulated field name causes the plugin to take its reCAPTCHA v2 validation branch. That branch does not apply the reCAPTCHA v3 score threshold or verify the expected action, allowing v3 bot protection to be completely bypassed.
How can the issue be remediated?
Update the Grav Form plugin to version 9.1.20, which contains the fix.