CVE-2026-86194 - Grav Form Plugin before 9.1.22 Cross-Page Form Execution
Brief
CVE ID : CVE-2026-86194
Published : Sept. 5, 2026, 1:18 p. m.
- 7 hours, 27 minutes ago
Description : Grav Form Plugin before 9.
- 22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.
Severity: 6.9
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...