CVE-2026-47266
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Formie plugin for Craft CMS before versions 2.2.21 and 3.1.26 allowed unauthenticated users to modify existing submissions by posting a known or guessed submission ID to the formie/submissions/save-submission endpoint.
Risk Assessment
Unauthorized modification of submissions can lead to integrity violations of form data, potentially impacting business processes relying on that data.
Recommendation
It is recommended to update the Formie plugin to version 2.2.21 or 3.1.26 (depending on the branch used) or later.
Other vulnerabilities in Formie
See all- CVE-2026-52889Critical
Formie, a Craft CMS plugin for creating forms, before version 3.1.27 passes request-derived Hidden field defaults (e.g., User Agent, URL, query parameters) to Craft's Twig rendering layer. An unauthenticated attacker can place Twig syntax in these values, leading to server-side template evaluation (SSTI), potentially resulting in information disclosure, application state modification, or remote code execution.
- CVE-2026-45697Critical
Formie, a Craft CMS plugin, prior to versions 2.2.20 and 3.1.24 allows unauthenticated users to submit crafted values into Hidden fields that are evaluated as Twig during submission handling. This can lead to serious compromise of the Craft site.
Original NVD description (English source)
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.