The form builder plugin known as Formie for Craft CMS allows public form submissions. In versions before 2.2.23 and 3.1.31, the anonymous submit route processes a client‑supplied submission identifier without checking ownership, session binding, or a valid edit token. Because the system accepts any numeric ID, an attacker can guess sequential identifiers and overwrite another user’s in‑progress, multi‑page or save‑for‑later submission. The modified data is persisted and later forwarded to notifications or integrations when the form is completed, resulting in a direct integrity breach of user data.

Any installation of the verbb Formie plugin running a version older than 2.2.23 or 3.1.31 on a Craft CMS site is affected. The flaw exists irrespective of authentication settings because the submit endpoint is publicly reachable. Users who rely on multi‑page or save‑later form functionality are particularly at risk as the overwrite can happen only before the submission is finalized.

The CVSS score of 8.2 classifies this issue as high severity. No EPSS data is available and the vulnerability is not yet listed in CISA’s KEV catalog, so no public exploits are documented. Nevertheless, the exploitation path is straightforward: an unauthenticated attacker can send repeated POST requests to the submit URL with incrementing IDs. Once an overwrite occurs, the altered data is stored and triggered through downstream systems, raising the potential impact across confidentiality, integrity, and availability of the affected application.