Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Grav Form plugin lets attackers skip reCAPTCHA v3 check

CVE-2026-85602 · published 1 day ago
Summary

The Form plugin used in Grav websites (versions 8.0.6 through 9.1.19) can be tricked into treating a reCAPTCHA v3 token as a v2 token, which disables the score test that blocks automated traffic. This means bots could submit forms without being blocked. Upgrade the plugin to version 9.1.20 or later to close the gap.

What to do
  • Update getgrav grav to version 9.1.20 or later.
  • Update getgrav grav-plugin-form to version 9.1.20 or later.
Affected software
VendorProductAffected versions
getgrav grav < 9.1.20
getgrav grav-plugin-form < 9.1.20
Original advisory text
Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass
The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 field name (g-recaptcha-response instead of token), causing validation to use the v2 branch, which never applies the score threshold or verifies the expected action. This results in a complete bypass of reCAPTCHA v3 bot protection. The issue is fixed in version 9.1.20.
References
Severity
9.3 Critical
CVSS 3.1: 5.3 (MITRE)
Type
CWE-807Reliance on Untrusted Inputs in a Security Decision
Timeline
Published4 Sep 2026
Updated5 Sep 2026
First seen4 Sep 2026
Sources
CVE-2026-85602 · NVD
CVE-2026-85602 · MITRE
Monitor software like this
Free during beta