Grav CMS scheduler‑webhook plugin contains a short‑circuit logic flaw in its token validation routine that treats a null token as valid. This flaw permits an unauthenticated attacker to bypass authentication entirely and trigger any scheduled job configured on the site. The operator‑defined commands run under the web‑server user account, giving the attacker the ability to execute arbitrary code on the host.

The vulnerability impacts the Grav CMS scheduler‑webhook plugin distributed by Trilby Media. Any system running Grav CMS with this plugin installed, regardless of the Grav core version, is potentially affected. No specific product version list is provided, so all installations that include the unpatched plugin should be reviewed.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the current time. The vulnerability is not listed in CISA KEV. Exploitation requires only a single unauthenticated POST request to the /scheduler-webhook endpoint, making the attack path straightforward and requiring no additional credentials.