QwikSec

Security Database

CVE

CWE

Training

CVE-2026-47266

Published: May 29, 2026

Modified: May 29, 2026

PUBLISHED

Description

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26.

Vendor	Product	Versions
verbb	formie	affected `< 2.2.21` affected `>= 3.0.0-beta.1, < 3.1.26`

Weaknesses (CWE)

References

https://github.com/verbb/formie/security/advisories/GHSA-pgxq-p76c-x9cg

x_refsource_CONFIRM

https://github.com/verbb/formie/releases/tag/2.2.21

x_refsource_MISC

https://github.com/verbb/formie/releases/tag/3.1.26

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.