Medium severity · published Sep 5, 2026
CVE-2026-86194
Grav Form Plugin before 9.1.22 Cross-Page Form Execution
6.9
CVSS
0.6%
EPSS
No
On KEV
Description
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav-plugin-form · getgrav
before 9.1.22 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86194
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86194
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-33m4-m988-5fvh
www.vulncheck.com
https://www.vulncheck.com/advisories/grav-form-plugin-before-9.1.22-cross-page-form-execution
More from grav-plugin-form
7.7
CVE-2026-42845
Grav: Anonymous Page Content Overwrite via Form File Upload filename Override
6.5
CVE-2026-69087
Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig
5.4
CVE-2026-42842
grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel
5.3
CVE-2026-85602
Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass