Description
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav-plugin-form | < 9.1.22 | 9.1.22 |
References
- GitHub Security Advisory (GHSA-33m4-m988-5fvh) vendor-advisory
- VulnCheck Advisory: Grav Form Plugin before 9.1.22 Cross-Page Form Execution third-party-advisory