Is CVE-2026-47266 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47266 being exploited in the wild.

How severe is CVE-2026-47266?

High severity, with a CVSS score of 4, published 29 May 2026.

Which products and versions are affected?

verbb/formie (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=3.1.26; Verbb Formie = 3.0.0, < 3.1.26.

Is there a fix for CVE-2026-47266?

Yes. verbb/formie (Packagist): upgrade to 3.1.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47266 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47266?

Check whether you run verbb/formie (Packagist) or Verbb Formie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47266: Verbb Formie authorization bypass in form submissions

Q: Is there a fix for CVE-2026-47266?

Yes. verbb/formie (Packagist): upgrade to 3.1.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47266 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-47266?

Check whether you run verbb/formie (Packagist) or Verbb Formie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47266 · Severity: high · CVSS 4 · Published 2026-05-29

Formie is a plugin for Craft CMS used to create and manage web forms. A security flaw allows unauthorized individuals to modify or overwrite existing form submissions by guessing or obtaining a submission ID. This could lead to the corruption of customer data or the unauthorized alteration of records submitted through the website.

Technologies: verbb/formie (Packagist), Verbb Formie. Vendors: Packagist, Verbb.

Quick answers

Is CVE-2026-47266 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47266 being exploited in the wild.
How severe is CVE-2026-47266?: High severity, with a CVSS score of 4, published 29 May 2026.
Which products and versions are affected?: verbb/formie (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=3.1.26; Verbb Formie < 2.2.21, < 3.1.26, < 2.2.21, >= 3.0.0, < 3.1.26.
Is there a fix for CVE-2026-47266?: Yes. verbb/formie (Packagist): upgrade to 3.1.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47266 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47266?: Check whether you run verbb/formie (Packagist) or Verbb Formie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

verbb/formie (Packagist): upgrade to 3.1.26 or later
```
composer require verbb/formie:^3.1.26
```

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The 'formie/submissions/save-submission' endpoint failed to properly validate the authorization of unauthenticated users attempting to edit existing records. By sending a POST request with a specific submission ID, an attacker can modify the data of that submission without any prior authentication or user interaction. The fix introduces a 'submissionEditToken' to ensure that only authorized requests can modify existing entries.

Affected products

Verbb Formie < 2.2.21, >= 3.0.0, < 3.1.26

Identifiers

CVE-2026-47266
GHSA-pgxq-p76c-x9cg

Timeline

2026-05-19: patched: Versions 2.2.21 and 3.1.26 released
2026-05-29: advisory: GitHub Advisory and NVD record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.