CVE-2026-45697
A flaw in the Formie plugin for Craft CMS lets anyone submit crafted data into hidden form fields that is executed as Twig code. This can give attackers full control over the site. The issue is fixed in newer plugin versions.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Formie plugin for Craft CMS versions earlier than 2.2.20 and 3.1.24. Site owners using these versions are affected.
Real-world impact
An attacker could run arbitrary code on the web server, steal sensitive data, deface the site, or use it as a foothold for further attacks.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited over the network with no authentication, no user interaction, and it can compromise confidentiality, integrity, and availability of the entire site.
What to do about it
- 01Upgrade the Formie plugin to version 2.2.20 or later, or 3.1.24 or later.
- 02Verify that the plugin update is applied successfully.
- 03Restart Craft CMS if required to load the new plugin version.
NVD-referenced vendor advisory
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.