CVE-2026-86194

CVE-2026-86194 affects the Grav Form Plugin before version 9.1.22 . The vulnerability is a cross-page form execution flaw: the plugin fails to verify page authorization when resolving forms by name across pages. As a result, anonymous visitors can POST to any public page using the name of a form ...

CVE-2026-86194 Grav Form Plugin before 9.1.22 Cross-Page Form Execution

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save,...

PT-2026-86419

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save,...