← Back to the live CVE advisory feed

CVE-2026-86196: Product identification pending

Severity

8.7 (HIGH)

Affected versions

Before 1.0.20

Fixed version

1.0.20

Patch status

Patched

Published

2026-09-05T13:18:14.980

Modified

2026-09-05T13:18:14.980

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.

View the official NVD record for CVE-2026-86196

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.