CVE-2026-86194: Grav Form Plugin before 9.1.22 Cross-Page Form Execution
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav Form Pluginto a version that resolves this vulnerability.Fixed in 9.1.22
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Sites using Grav Form Plugin versions before 9.1.22 are exposed if they have a public page that accepts POST requests and forms defined by name on login-restricted or unpublished pages.
What does an attacker need to exploit this issue?
An attacker only needs anonymous access to a public page and the name of a form defined on a restricted or unpublished page. They can submit a POST request to the public page using that form name.
What actions could be triggered without authentication?
Depending on the restricted form's configured actions, an attacker may trigger save, upload, email, or call actions.
How can I tell whether my site is affected?
Check whether the installed Grav Form Plugin version is earlier than 9.1.22. Also review forms on login-restricted or unpublished pages and determine whether their names can be submitted through public pages.