CVE-2026-86194 Grav Form Plugin before 9.1.22 Cross-Page Form Execution

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save,...

CVE-2026-86194

CVE-2026-86194 affects the Grav Form Plugin before version 9.1.22 . The vulnerability is a cross-page form execution flaw: the plugin fails to verify page authorization when resolving forms by name across pages. As a result, anonymous visitors can POST to any public page using the name of a form ...

PT-2026-86419

Name of the Vulnerable Software and Affected Versions Grav Form Plugin versions prior to 9.1.22 Description Insufficient page authorization verification occurs when resolving forms by name across pages. This allows anonymous visitors to execute form actions—such as saving, uploading, emailing, or...