The Grav Form plugin (getgrav/grav-plugin-form) before version 9.1.20 validates a reCAPTCHA response based only on the name of the payload field. When a site is configured to use reCAPTCHA v3, an attacker can submit the v3 token under the legacy field name used for v2, which causes the plugin to route validation through the v2 logic. This branch does not enforce the score threshold or check the expected action, resulting in a complete bypass of the bot protection layer. The classical weakness here is an improper restriction on a resource that leads to unauthorized credential usage, identified as CWE‑807.

Affected systems are Grav CMS installations that include the Grav Form plugin, specifically plugin versions 8.0.6 through 9.1.19. The vulnerability is present in all releases in that range regardless of other plugins or configurations. Version 9.1.20 and later contain the fix.

The CVSS score is 9.3, indicating critical severity. The EPSS score is not available, so the probability of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote anonymous attacker submitting a form and placing a reCAPTCHA v3 token into the legacy field name (g‑recaptcha‑response). Because the plugin validates using the v2 branch, the token is accepted without score verification or action checking, allowing bot traffic to bypass protection. Given the high severity score and the potential for widespread abuse, the risk to affected sites is high and must be rectified immediately.