VULNERABILITY INTELLIGENCE

CVE-2026-109319

CVSS score5.3 MEDIUM

EPSS probability0.33%

CISA KEVNot currently listed

Published2026-10-12

Last modified2026-10-15

Description

Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce…