Search

CVE-2026-86194 - Grav Form Plugin before 9.1.22 Cross-Page Form Execution

CVE ID : CVE-2026-86194 Published : Sept. 5, 2026, 1:18 p. m. • 7 hours, 27 minutes ago Description : Grav Form Plugin before 9. 1. 22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication. Severity: 6.9 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...