Quick answers
- Is CVE-2026-109312 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-109312 being exploited in the wild.
- How severe is CVE-2026-109312?
- High severity, with a CVSS score of 8.1, published 12 October 2026.
- Which products and versions are affected?
- Getgrav Login Plugin 2.7.0 through 3.9.8.
- Is there a fix for CVE-2026-109312?
- Yes: fixed in 3.9.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-109312 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-109312?
- Check whether you run Getgrav Login Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.9.9
Technical details
The vulnerability exists in the processUserProfile() function, which verifies that a session user exists but fails to check whether a pending 2FA session is fully authorized. An attacker with the victim's password can craft an unprotected page form that invokes the update_user action during the pending 2FA window and modify the twofa_enabled field to disable two-factor authentication. This requires the attacker to have the ability to publish a page without access rules and the twofa_enabled field to be included in the Login plugin's profile configuration.
Affected products
- Getgrav Login plugin 2.7.0 through 3.9.8
Timeline
- 2026-09-23: disclosed
- 2026-10-12: advisory