CVE-2026-85602

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

CVE-2026-85602 Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

CVE-2026-85602

CVE-2026-85602 affects the Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 . The plugin selects which reCAPTCHA validation branch to execute based solely on the field key present in the submitted payload. On a site configured for reCAPTCHA v3 , an unauthenticated attacke...

CVE-2026-85602: Reliance on Untrusted Inputs in a Security Decision

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

reCAPTCHA v3 - Critical - Access bypass - SA-CONTRIB-2020-019

The reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3. If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for attackers to submit invalid or incomplete forms. This vulnerability only affects forms that are...