CVE-2026-85602: Reliance on Untrusted Inputs in a Security Decision in getgrav grav-plugin-form
Description
The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 field name (g-recaptcha-response instead of token), causing validation to use the v2 branch, which never applies the score threshold or verifies the expected action. This results in a complete bypass of reCAPTCHA v3 bot protection. The issue is fixed in version 9.1.20.
CVSS v4.0
Score 9.3critical
Affected software
getgrav
grav-plugin-form
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 rely on the presence of specific response field keys to determine which reCAPTCHA version to validate. On sites configured for reCAPTCHA v3, an attacker can submit their v3 token under the v2 response field name (g-recaptcha-response instead of token). This causes the plugin to use the v2 validation branch, which does not enforce the v3 score threshold or verify the expected action, effectively bypassing the reCAPTCHA v3 bot protection mechanism. The vulnerability is resolved in version 9.1.20.
Potential Impact
An anonymous attacker can bypass reCAPTCHA v3 bot protection on affected versions of the Grav Form plugin by manipulating the response field key in the submitted form data. This bypass undermines the bot detection and mitigation controls provided by reCAPTCHA v3, potentially allowing automated or malicious submissions to succeed without proper validation.
Mitigation Recommendations
Upgrade the Grav Form plugin to version 9.1.20 or later, where this vulnerability is fixed. Patch status is confirmed by the vendor advisory stating the issue is resolved in version 9.1.20. Until upgraded, reCAPTCHA v3 protection can be bypassed as described.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-04T11:00:28.731Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9aada3acd9273b4981da2d
Added to database: 09/04/2026, 11:38:11 UTC
Last enriched: 09/07/2026, 11:22:39 UTC
Last updated: 10/17/2026, 18:48:23 UTC
Views: 83
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.