Grav Login plugin CVE-2026-109314

Exploitation requires the attacker to already hold a publisher-level account with permission to author/publish pages, and to create a page at the plugin's password-reset route so that Login::getPage() renders attacker-controlled content on that route. It additionally requires a more-privileged victim to independently initiate a password reset and open the emailed reset link, at which point the rendered page exposes that victim's username and bearer reset token. Limiting factors: the PR:L authentication requirement (no anonymous exploitation), the dependence on victim interaction (UI:P - clicking the emailed link), and applicability only to Grav Login plugin versions from 1.2.0 up to but not including 3.9.9.

This is a credible, moderate-to-high priority issue for organizations running the affected Grav Login plugin, but not an emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H) correctly reflects a network-reachable flaw of low complexity that requires an authenticated low-privileged attacker (PR:L - a 'publisher' account) and passive victim interaction (UI:P - the victim must open an emailed reset link). The high confidentiality and integrity impact is justified because leaking a valid reset token enables takeover of more privileged accounts, i.e. privilege escalation. However, the real-world exploitation signals are weak: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Exploitation is also gated by two non-trivial preconditions - the attacker already needs a publisher account on the target, and a more-privileged victim must independently trigger a password reset and click the link. Net assessment: a genuine privilege-escalation/account-takeover bug worth patching promptly where the plugin is deployed, but the authentication requirement and dependence on victim behavior make widespread opportunistic exploitation unlikely; treat as targeted rather than mass-exploitable. No key signals are internally conflicting, but EPSS and POC data are simply absent rather than contradictory.

An attacker who holds a publisher-level account on a Grav site authors a malicious page at the plugin's password-reset route. When a higher-privileged user (e.g. an administrator) later requests a password reset and clicks the emailed link, Login::getPage() renders the attacker-controlled page, which captures and exposes the victim's username and bearer reset token - allowing the attacker to complete the reset and seize the privileged account. No public proof-of-concept is referenced; exploitation requires the attacker's existing publisher access plus victim interaction (clicking the reset link).