Skip to content
OpenAdvisories

Product · getgrav

grav-plugin-comments

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-100672

    grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

    The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin servic…

    getgrav grav-plugin-comments