CVE-2026-85602
Received Received - Intake

reCAPTCHA v3 Bypass in Grav Form Plugin

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 field name (g-recaptcha-response instead of token), causing validation to use the v2 branch, which never applies the score threshold or verifies the expected action. This results in a complete bypass of reCAPTCHA v3 bot protection. The issue is fixed in version 9.1.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85602
EUVD
EUVD-2026-71025

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav-plugin-form From 8.0.6 (inc) to 9.1.19 (inc)
getgrav grav-plugin-form 9.1.20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Grav Form plugin versions 8.0.6 through 9.1.19. It allows an attacker to bypass reCAPTCHA v3 bot protection by submitting a reCAPTCHA v3 token under the v2 response field name (g-recaptcha-response). The plugin incorrectly selects the reCAPTCHA version for validation based on the payload key name rather than the configured version. Since the v2 validation branch does not enforce score thresholds or action checks, attackers can bypass security controls entirely.

Detection Guidance

Check the installed version of the Grav Form plugin. If it is between 8.0.6 and 9.1.19, the system is vulnerable. Run: grep -r "grav-plugin-form" /path/to/grav/installation. Compare the version number in the plugin's metadata or composer.json file.

Impact Analysis

An attacker could exploit this to bypass bot protection on forms using reCAPTCHA v3, potentially allowing automated submissions of spam, fraudulent registrations, or other malicious activities. Websites relying on reCAPTCHA v3 for security may unknowingly accept automated inputs as valid, undermining intended protections.

Compliance Impact

This vulnerability could impact compliance by failing to enforce automated input restrictions required for data integrity and security. For GDPR, it may undermine measures to prevent automated data scraping or spam. For HIPAA, it could allow unauthorized automated submissions that compromise protected health information processing controls.

Mitigation Strategies

Upgrade the Grav Form plugin to version 9.1.20 or later immediately. If upgrading is not possible, disable the plugin or reconfigure reCAPTCHA to use v2 with strict validation as a temporary measure. Monitor for suspicious activity or unauthorized submissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart