The Grav Form Plugin fails to verify page authorization when resolving forms by name across pages. Anonymous visitors can send POST requests to any public page with the name of a form that is defined on a login‑restricted or unpublished page, causing the plugin to execute the form's defined actions—such as saving data, uploading files, sending email, or calling external services—without requiring authentication. This lack of access control enables attackers to trigger potentially sensitive operations, including uploading files that could be used for code execution or exfiltration of data.

Vendors affected are getgrav Grav with the Grav Form Plugin. Any installation using a plugin version earlier than 9.1.22 is vulnerable. This includes any Grav site that has not upgraded past that release. The vulnerability occurs regardless of the Grav core version as long as the plugin remains pre‑9.1.22.

With a CVSS base score of 6.9, the vulnerability is considered moderate severity. There is no EPSS value available and the issue is not listed in CISA’s KEV catalog. The likely attack vector is a web‑based POST request to a publicly accessible page that includes a restricted form name; no authentication is required. Because of the ease of triggering arbitrary form actions, attackers could use the upload or email features to place malicious content or exfiltrate data, and the exploitability is therefore significant for sites that expose such forms.