CVE-2026-85602

The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 selects which reCAPTCHA validation path to run based solely on which response field name is present in the submitted form payload. On a site configured for reCAPTCHA v3, an unauthenticated attacker can submit their v3 token under the v2 field name (g-recaptcha-response instead of token), which routes validation into the v2 branch that never applies the score threshold or verifies the expected action. This results in a complete bypass of the site's reCAPTCHA v3 bot protection, allowing automated traffic to submit forms and pollute submissions, leads, or downstream form-driven workflows. Any Grav site running the Form plugin in the affected range with reCAPTCHA v3 configured is exposed; the data does not describe v2-only configurations as vulnerable. No public proof-of-concept or confirmed in-the-wild exploitation is known, and EPSS currently estimates a 0.3% probability of exploitation within 30 days.

What to do: Upgrade the Form plugin to version 9.1.20 or later, which fixes the reCAPTCHA version-selection flaw. As an interim measure, switch exposed forms to server-verified reCAPTCHA v2 or layer additional anti-spam controls (e.g., rate limiting and server-side validation), and audit any workflows that trust v3 scores for automated decisions such as lead acceptance or notification. Although exploitation status is currently 'none known', the flaw is network-reachable and unauthenticated (CVSS 4.0 base 9.3), so patch promptly.