CVE-2026-109319

Name of the Vulnerable Software and Affected Versions Grav Guestbook plugin versions 0.5.0 through 0.5.1

Description Missing authorization and cross-site request forgery (CSRF) issues exist in admin moderation actions. CSRF is a flaw where an attacker tricks a victim's browser into performing an unwanted action on a different website. Authenticated users without the admin.guestbook permission, or external sites leveraging a moderator's session through GET requests that lack a nonce (a unique token used to prevent replay attacks), can delete or approve guestbook entries via the delete, approve, and approveAll actions.

Recommendations Update Grav Guestbook plugin to a version later than 0.5.1.