External risk intelligence

Grav Form Plugin reCAPTCHA v3 Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85602

The vulnerability affects a form submission plugin on a web application. Such plugins are designed to be public-facing and reachable by any internet user accessing the website's forms, making the vulnerable endpoint an inherent part of the public web interface.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw in the Grav Form plugin allows anonymous attackers to bypass bot protection for reCAPTCHA v3. This issue affects how the plugin validates user submissions, potentially enabling malicious actors to circumvent anti-bot measures on websites using this plugin.

Bypasses website bot protection.
Critical for public-facing form security.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass reCAPTCHA v3 protection by submitting a specially crafted request to a website using the Grav Form plugin. By placing a reCAPTCHA v3 token in a field intended for v2 validation, the attacker tricks the plugin into skipping the score threshold and action verification, allowing any submission to pass as legitimate. This could enable automated abuse of web forms.

Publicly accessible web forms.
Submitting a v3 token in a v2 field.
Complete bypass of bot protection.

Live Threat

Current exploitation, exposure, and threat context

A website's reCAPTCHA v3 bot protection could be bypassed, allowing unauthenticated attackers to submit form data without proper verification. This occurs when an attacker crafts a malicious request containing a reCAPTCHA v3 token under a field name expected by the older v2 validation, which does not enforce score or action checks.

Website form submissions.
Attacker bypasses reCAPTCHA validation.
Automated abuse of web forms.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Grav Form plugin's reCAPTCHA validation bypass affects any site using the plugin with reCAPTCHA v3 enabled. Responsibility for addressing this likely falls to the platform or application team managing the Grav CMS and its plugins, in coordination with the security team for exposure assessment. The first practical step is to identify all instances of the affected plugin, confirm their exposure and criticality, and then plan remediation, potentially involving vendor coordination if the Grav core or plugin vendor provides guidance.

Application owners to address.
Verify reCAPTCHA v3 configuration.
Plan secure update deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Grav Form plugin?

The Grav Form plugin is a component for the Grav flat-file content management system. It enables developers to easily create, process, and validate web-based forms, such as contact requests or user registration fields, directly within their Grav sites.

How does CVE-2026-85602 create a security weakness?

This vulnerability is an example of a CWE-807 (Reliance on Untrusted Inputs in a Security Decision). Because the plugin decides which reCAPTCHA version to use based solely on the submitted field name, it fails to enforce necessary security checks. By providing a v3 token in a v2 field, an attacker tricks the software into skipping the required score and action verification entirely.

What triggers this bypass vulnerability?

An attacker triggers this by submitting a specially formatted request where a reCAPTCHA v3 token is placed in the 'g-recaptcha-response' field, which the plugin expects for v2 validation. This issue does not occur if the site is not using reCAPTCHA v3, or if the form submission does not rely on the plugin's flawed logic to identify the verification protocol.

Why should I care about this if my site uses forms?

If you use this plugin, your bot protection can be completely circumvented. Halo Surface Signal indicates this is highly relevant because form plugins are designed to be public-facing and reachable by anyone on the internet, meaning these vulnerable endpoints are typically exposed to the open web and prime for automated abuse.

Do I need to update my software to fix this?

Yes. The first step is to verify if your Grav instance is running a vulnerable version of the Form plugin between 8.0.6 and 9.1.19. You should plan to update to version 9.1.20 or later, which contains the fix, to ensure your reCAPTCHA v3 implementation correctly validates incoming form submissions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.