CVE-2026-16144
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
The Kali Forms plugin for WordPress is vulnerable to remote code execution via the `_save_data()` function. Insufficient validation of the `thisPermalink` field allows unauthenticated attackers to pass a controlled string to `call_user_func()`, enabling code execution on the server.
Risk Assessment
An attacker can execute arbitrary code on the server, leading to complete site takeover and potentially other resources.
Recommendation
Update the Kali Forms plugin to a version that fixes input validation.
Other vulnerabilities in Kali Forms
See all- CVE-2026-59542High
The Kali Forms plugin version 2.4.18 and earlier allows a user with the Subscriber role to delete arbitrary files on the server. The vulnerability does not require special privileges beyond a standard subscriber account.
- CVE-2026-81276Medium
Kali Forms version 2.4.23 and earlier has an Unauthenticated Broken Access Control vulnerability. This means an unauthenticated attacker can access functions that should be protected.
- CVE-2026-65446High
A Cross Site Scripting (XSS) vulnerability in the Kali Forms plugin for WordPress versions up to 2.4.18. An unauthenticated attacker can inject a malicious script.
- CVE-2026-15395High
The Kali Forms plugin for WordPress (versions up to 2.4.18) is vulnerable to stored XSS via the 'digitalSignature' field. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when users access the affected page.
- CVE-2026-11580Medium
The Kali Forms WordPress plugin before version 2.4.17 lacks a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by the plugin.
- CVE-2026-11579Medium
The Kali Forms WordPress plugin before version 2.4.17 does not verify that a file upload is associated with an existing form configured with a file-upload field, allowing unauthenticated users to upload files to the WordPress Media Library. Uploads are limited to default-allowed MIME types, so code execution is not possible.
- CVE-2026-9107Medium
The Kali Forms plugin for WordPress up to version 2.4.13 is vulnerable to Stored XSS via the 'meta[kaliforms_field_components]' parameter. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts that execute when a user visits the compromised page.
- CVE-2026-11581Medium
The Kali Forms WordPress plugin before 2.4.13 does not sanitize a form field's caption before outputting it as a column header on the admin form-entries screen. Users with Contributor-level access or above can inject JavaScript that executes in an administrator's session. A missing capability check in the post-duplication action allows the Contributor to publish the malicious form so an administrator renders it.
Original NVD description (English source)
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.