CyberRota Analysis
AI-GeneratedThe Grav Form Plugin prior to version 9.1.22 is vulnerable due to inadequate page authorization verification, allowing unauthorized users to execute actions on forms associated with restricted or unpublished pages. This flaw enables attackers to perform operations such as saving, uploading, or emailing data by simply posting to public pages with the names of these restricted forms. Organizations using this plugin, especially those managing sensitive data or user interactions, should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.