Description

The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 field name (g-recaptcha-response instead of token), causing validation to use the v2 branch, which never applies the score threshold or verifies the expected action. This results in a complete bypass of reCAPTCHA v3 bot protection. The issue is fixed in version 9.1.20.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T12:17:23.903Z",
  "pubdate": "2026-09-04T12:17:23.903Z",
  "executiveSummary": "The Grav Form plugin (getgrav/grav-plugin-form) is susceptible to a security bypass vulnerability affecting its reCAPTCHA validation logic. This issue enables an unauthenticated attacker to circumvent reCAPTCHA v3 bot protection mechanisms entirely.\nThe vulnerability originates from an insecure implementation of reCAPTCHA version selection, which relies exclusively on the presence of specific field keys within the HTTP POST request payload. By manipulating the payload structure, an attacker can coerce the plugin into executing the reCAPTCHA v2 validation routine instead of the configured v3 logic.\nBecause the v2 validation branch fails to enforce the score threshold and expected action parameters required for v3 verification, the server-side validation effectively accepts malicious requests that should otherwise be flagged by bot detection.\nThis flaw affects versions 8.0.6 through 9.1.19 of the plugin. Successful exploitation allows for automated submission of forms, potentially leading to spam distribution, credential stuffing, or brute-force attacks against protected endpoints, bypassing the security controls intended to mitigate these threats.\nThe issue is patched in version 9.1.20, and upgrading is strongly advised to maintain application integrity.",
  "technicalDetails": "The vulnerability resides in the validation logic of the Grav Form plugin, which manages reCAPTCHA authentication. The plugin improperly implements conditional logic for determining whether to process a submission using the reCAPTCHA v2 or v3 API. Instead of verifying the actual configuration or the nature of the token provided, the plugin performs an existence check on the HTTP request body fields.\nSpecifically, the plugin identifies the reCAPTCHA version based on the key name used in the submitted payload. If the key associated with reCAPTCHA v2 (g-recaptcha-response) is present, the plugin forces the use of the v2 validation method, ignoring the intended v3 configuration. Conversely, if a v3-specific token key is detected, it proceeds to v3 validation. This design assumes the client-side implementation will always submit the correct identifier for the configured version.\nAn unauthenticated attacker can exploit this by intercepting a legitimate form submission and modifying the payload. By substituting a valid reCAPTCHA v3 token into the field expected by the v2 logic (g-recaptcha-response), the attacker triggers the v2 validation branch. The backend, expecting a legacy v2 response, treats the submission accordingly.\nThe critical security failure occurs because the v2 validation branch does not contain the logic required to enforce the threshold scores or 'action' verification parameters intrinsic to v3. Since the v2 API verification is conceptually incompatible with v3 tokens and checks, the plugin fails to properly validate the authenticity of the v3 token. Consequently, the backend returns a successful validation status regardless of the bot's risk score.\nThe attack flow follows these steps: 1) The attacker targets a form protected by reCAPTCHA v3. 2) The attacker obtains a valid v3 token. 3) The attacker submits the request to the Grav Form endpoint, replacing the expected token field with the 'g-recaptcha-response' parameter, injecting the v3 token therein. 4) The plugin detects the 'g-recaptcha-response' key and erroneously routes the request through the v2 validation service. 5) The v2 validation service, being improperly invoked for this context, confirms the presence of the response without checking the v3-specific security requirements. 6) The plugin accepts the submission as legitimate, granting the attacker access to form processing. This flaw allows for seamless bypass of protective measures across all affected versions from 8.0.6 up to 9.1.19."
}