Loading story…
A mass disclosure detailed 11 vulnerabilities in Grav CMS and the getgrav/grav-plugin-api package, with the most severe issues affecting the API plugin before 1.0.13 and Grav CMS before 2.0.13. Multiple API endpoints failed to enforce API key scope caps or relied on bare isSuperAdmin() checks instead of scope-aware permission validation, allowing least-privilege or narrowly scoped keys to perform privileged actions. Reported impacts include creating unrestricted API keys (CVE-2026-72826), promoting users or invited accounts to super-admin (CVE-2026-72828, CVE-2026-72829, CVE-2026-72833), and disabling 2FA for non-super accounts without a TOTP code via POST /api/v1/users/{user}/2fa/disable (CVE-2026-72822).
The disclosure also included several paths to remote code execution. In the API plugin, CVE-2026-72830 allows attackers with api.config.write access to alter scheduler settings and inject commands through scheduler.custom_jobs, while CVE-2026-72824 can enable Twig processing during page saves and lead to server-side template injection under certain settings. In core Grav CMS, CVE-2026-72819 allows authenticated users to upload a malicious ZIP through Flex Objects and write PHP files to the web root, and CVE-2026-72827 enables Twig injection through email-action parameters that can execute OS commands when forms are submitted. Advisories recommend upgrading to Grav 2.0.13 and API plugin 1.0.13, rotating API keys, and auditing super-admin accounts, invitations, scheduler jobs, and 2FA settings; no active exploitation was reported at publication time.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
17 events from the most recent confirmed update back to the earliest known activity.
A new CVE record was received for a Grav API plugin missing-authorization flaw in MenubarController::executeAction() that lets any authenticated user with api.access invoke privileged menubar actions without enforcement of the registered authorize requirement. Grav API plugin version 1.0.14 is listed as unaffected, and the advisory notes impact is latent on stock installations but affects plugins relying on authorize semantics.
A new CVE record was received for a missing authorization flaw in the Grav API plugin's userPassesAuthorize() logic, which checks account privileges but not the calling API key's scopes. An authenticated attacker using a scoped key created on a privileged account can bypass intended scope restrictions and access authorize-gated UI metadata and item definitions; version 1.0.14 is listed as unaffected.
A new CVE record was received for a missing authorization flaw in the Grav API plugin's BlueprintPathResolver::resolveUserScope(), where API key scope is not properly validated against another user's scope. An attacker with an api.media.write-scoped key minted on a super-admin account can browse or write files in another user's scope via /blueprint-files and /blueprint-upload; version 1.0.14 is listed as unaffected.
A new CVE record was received for an open redirect flaw in the Grav API plugin's SsoController::sanitizeReturnTo(), where backslashes can bypass a check for protocol-relative URLs and redirect OAuth login flows to attacker-controlled sites. Versions before 1.0.14 are affected, while version 1.0.14 is listed as unaffected.
A new CVE record was received for a Grav API plugin server-side template injection flaw in the translate() endpoint that lets an attacker with api.pages.write persist pages with process.twig enabled and trigger Twig payload execution at render time. The issue affects grav-plugin-api versions before 1.0.15, while version 1.0.15 is listed as unaffected.
A new CVE record was received for a Grav API plugin flaw in versions 1.0.6 through 1.0.11 where scoped API keys minted on super-admin accounts can bypass scope caps on four write endpoints and grant super-admin rights to arbitrary accounts. The issue is fixed in version 1.0.13.
A new CVE record was received for a Grav API plugin ConfigController flaw that lets an attacker with api.config.write inject commands into scheduler.custom_jobs for execution via Symfony Process. The issue is fixed in version 1.0.13.
A new CVE record was received for a UsersController create/update scope-cap bypass that allows an api.users.write-scoped key minted on a super account to create or promote a full super account. Grav API plugin 1.0.13 is listed as unaffected.
A new CVE record was received for a Grav API plugin InvitationsController flaw that lets a least-privilege api.users.write key created on a super account generate invitations carrying super-admin flags. Accepting the invitation yields a fully privileged account.
A new CVE record was received for a Grav CMS server-side template injection flaw in email-action parameters that can lead to OS command execution and remote code execution when forms are submitted. Grav CMS 2.0.13 is listed as unaffected.
A new CVE record was received for improper scope validation in createApiKey, allowing a minimally scoped API key on a super account to create an unscoped full-access super key. The issue affects Grav API plugin versions before 1.0.13.
A new CVE record was received for an API key scope bypass in PagesController::guardTwigContent() that can enable process.twig and lead to SSTI and remote code execution under certain settings. Grav API plugin 1.0.13 is listed as unaffected.
A new CVE record was received for an authentication bypass in the Grav API plugin's disable2fa endpoint, which can let attackers disable 2FA for non-super accounts without a TOTP code. Version 1.0.13 is listed as unaffected.
A new CVE record was received for a Grav CMS remote code execution flaw in Flex Objects settings validation that lets authenticated users upload a malicious ZIP and write PHP files to the web root. Grav CMS 2.0.13 is listed as unaffected.
ThreatAft reported a mass disclosure affecting Grav CMS and its API plugin, describing 11 CVEs including multiple critical API authorization flaws and recommending upgrades to Grav 2.0.13+ and API plugin 1.0.13+.
VulnCheck published an advisory for CVE-2026-72830 covering remote code execution in the Grav API plugin's ConfigController scope-bypass flaw affecting versions before 1.0.13.
A verified getgrav/grav-plugin-api commit by rhukster introduced security fixes that enforce API key scopes during authorization, block non-super users from managing super-admin targets in several user endpoints, and restrict webhook URLs to public HTTP(S) destinations to prevent SSRF. The commit associates the changes with advisories GHSA-x7hm-jc32-v39j, GHSA-8gg4-rvvv-cq96, and GHSA-58q8-f7v4-w2vf.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
20 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcevulncheck.com
Open sourcevulncheck.com
Open sourcevulncheck.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities have been disclosed in widely deployed WordPress plugins, exposing internet-facing sites to **unauthenticated compromise**. `CVE-2026-3584` affects **Kali Forms** through version `2.4.9` and allows **remote code execution** because user-controlled input can be mapped into internal placeholder storage and later invoked via `call_user_func` in the `form_process` path. The issue is classified as `CWE-94` and carries a `CVSS 3.1` score with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating critical impact on confidentiality, integrity, and availability. A second flaw, `CVE-2026-4038`, affects **Aimogen Pro** through version `2.7.5` and enables **unauthenticated privilege escalation** through an arbitrary function call in `aiomatic_call_ai_function_realtime` caused by a missing capability check. According to the disclosure, attackers can invoke WordPress functions such as `update_option` to change the default registration role to administrator and enable user registration, effectively creating a path to full site takeover. The vulnerability is tracked as `CWE-862` and was likewise rated with a high-impact `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`.
Jun 29, 2026
A high-severity vulnerability tracked as **CVE-2026-62232** allows attackers to bypass two-factor authentication in **Grav** versions earlier than **2.0.4**. The flaw is in the login plugin's `regenerate2FASecret` task, which during the pending TOTP challenge checks only whether a user exists and fails to verify authorization, enabling an attacker who already knows a victim's password to reset the victim's 2FA secret and complete login with an attacker-generated code. The issue also lacks a required CSRF nonce on the secret-regeneration action, further weakening protections during authentication. Security advisories say the bug effectively reduces Grav's 2FA from password-plus-TOTP to **password-only security** for affected installations; the weakness is classified as **CWE-862** and has been fixed in **Grav 2.0.4**.
Jul 17, 2026
Multiple high-severity vulnerabilities were disclosed across popular **WordPress plugins**, creating pathways to account takeover, privilege escalation, and sensitive data exposure. The most severe issue, **CVE-2025-15521** in *Academy LMS* (<= `3.5.0`), allows **unauthenticated administrator account takeover** because the plugin’s password update flow relies on a **publicly exposed WordPress nonce** as authorization rather than validating user identity; *Wordfence* reported observing exploitation attempts in the wild and blocking dozens of attacks in a 24-hour period. Additional disclosures affect other plugins with different exploitation prerequisites and impacts. **CVE-2026-0726** in *Nexter Extension – Site Enhancements Toolkit* (<= `4.4.6`) is an **unauthenticated PHP object injection** via `nxt_unserialize_replace`, but it requires a usable **POP chain** from another installed plugin/theme to reach file deletion, data theft, or code execution. **CVE-2025-15347** in *Creator LMS* (<= `1.1.12`) enables **authenticated (Contributor+)** attackers to update arbitrary WordPress options due to a missing capability check, potentially leading to privilege escalation or site compromise. **CVE-2025-14977** in *Dokan* (<= `4.2.4`) is an **IDOR** in the `/wp-json/dokan/v1/settings` REST endpoint that lets **authenticated (Customer+)** users read/modify other vendors’ settings, including changing PayPal payout emails and accessing bank/payment details, enabling fraud and sensitive information disclosure.
Jun 29, 2026