Which versions of Grav Form are affected by CVE-2026-85602?

Grav Form plugin versions 8.0.6-9.1.19 contain a critical reCAPTCHA v3 bypass that allows unauthenticated attackers to defeat bot protection by sending a v3 token under the v2 field name, forcing…. A patch is available.

How to fix or mitigate CVE-2026-85602?

Within 24 hours, audit all Grav installations to identify those running versions 8.0.6-9.1.19 with reCAPTCHA v3 enabled. Within 7 days, implement interim protective controls: disable reCAPTCHA v3 protection and deploy an alternative CAPTCHA service (reCAPTCHA v2, hCaptcha, or Cloudflare Turnstile), add server-side rate-limiting and IP reputation filtering to form endpoints, and consider temporarily requiring authentication for sensitive forms. Within 30 days, monitor the getgrav/grav-plugin-form GitHub repository and official security advisories for a patched release and deploy immediately upon availability-expect remediation in version 9.1.20 or later.

Grav Form CVE-2026-85602

Q: What is the CVSS score of CVE-2026-85602?

CVE-2026-85602 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-71025 CRITICAL

Reliance on Untrusted Inputs in a Security Decision (CWE-807)

2026-09-04 VulnCheck

GHSA-v453-9p95-fp34

Authentication Bypass Grav Getgrav

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Trivial remote unauthenticated bypass (AV:N/AC:L/PR:N/UI:N) but impact is defeating bot protection enabling spam/abuse, so I:L/A:L and no confidentiality, not the input's H/H/H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 07, 2026 - 19:27 vuln.today

Patch available

Sep 04, 2026 - 13:02 EUVD

Analysis Generated

Sep 04, 2026 - 12:11 vuln.today

CVE Published

Sep 04, 2026 - 11:30 cve.org

CRITICAL 9.3

DescriptionCVE.org

The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 field name (g-recaptcha-response instead of token), causing validation to use the v2 branch, which never applies the score threshold or verifies the expected action. This results in a complete bypass of reCAPTCHA v3 bot protection. The issue is fixed in version 9.1.20.

AnalysisAI

reCAPTCHA v3 bot protection in the Grav Form plugin (getgrav/grav-plugin-form) 8.0.6 through 9.1.19 can be fully bypassed by an anonymous remote attacker who submits a token under the wrong field name. Because the plugin picks which reCAPTCHA validation branch to run based only on which response field key appears in the payload, sending a v3 token in the v2 field (g-recaptcha-response) forces the v2 code path, which never checks the risk score threshold or the expected action. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires the target Grav site to be configured for reCAPTCHA v3 specifically (the bypass forces the request into the v2 validation branch); sites using v2 are not affected by this technique. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 9.3) accurately reflects that exploitation is trivial, remote, and unauthenticated against a default v3-configured site - the attack is a single crafted form POST with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade the Grav Form plugin to version 9.1.20 or later, which fixes the version-selection logic; this is the primary and recommended action per GHSA-89j6-8h38-2cc3. … Detailed patch versions, workarounds, and compensating controls in full report.