EUVD-2026-44592
GHSA-56gf-mrhh-4cwv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable endpoint requires no authentication or user interaction; integrity impact is low as WordPress's MIME allowlist caps uploads to safe file types, with no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload files to the WordPress Media Library; the uploads are limited to WordPress's default-allowed MIME types, so this does not lead to code execution.
AnalysisAI
Unauthenticated file upload to the WordPress Media Library is possible in Kali Forms - Contact Form & Drag-and-Drop Builder versions before 2.4.17, because the plugin's upload handler accepts file submissions without verifying that a corresponding form with a file-upload field actually exists on the site. Any unauthenticated remote attacker can directly invoke the upload endpoint and deposit files into the Media Library. Impact is bounded by WordPress's core MIME type allowlist, which prevents upload of executable files and thereby rules out code execution; a publicly available proof-of-concept is confirmed by WPScan, and no CISA KEV listing is present at time of analysis.
Technical ContextAI
Kali Forms is a WordPress contact form and drag-and-drop builder plugin (CPE: cpe:2.3:a:unknown:kali_forms_-_contact_form_&_drag-and-drop_builder). The root cause maps to CWE-434 (Unrestricted Upload of File with Dangerous Type), though the practical severity is attenuated because WordPress enforces a global MIME type allowlist at the core level, blocking PHP and other executable extensions. The design flaw is a missing server-side gate: the file upload handler is fully decoupled from the form lifecycle - it never queries whether a form with a file-upload field configuration actually exists before accepting and persisting the uploaded file. This makes the endpoint behave as an open, context-free file ingestion point accessible to any HTTP client, rather than a controlled upload handler scoped to legitimate form submissions.
RemediationAI
Update the Kali Forms plugin to version 2.4.17 or later, which introduces the missing server-side validation ensuring file uploads are only accepted when the request corresponds to an existing, properly configured form that includes a file-upload field. The vendor-released patch is confirmed available and should be applied promptly given the existence of public exploit code. As a compensating control while patching is pending, administrators may deactivate the Kali Forms plugin entirely to eliminate the exposed endpoint - the trade-off being loss of all contact form functionality. Alternatively, a Web Application Firewall rule blocking POST requests to the plugin's file upload handler path can mitigate exploitation with minimal site impact. Auditing the WordPress Media Library for unexpected file uploads after the patch is applied is advisable to identify any files deposited prior to remediation. References: https://wpscan.com/vulnerability/fae38fd0-8183-4864-8dae-0cd33a220bec/ and https://vuldb.com/vuln/379197.
The Kali Forms plugin for WordPress contains a critical remote code execution vulnerability that allows unauthenticated
Stored cross-site scripting in the Kali Forms WordPress plugin (before 2.4.13) allows Contributor-level users to inject
Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.17 allows any authenticated Contri
Remote code execution in the Kali Forms WordPress plugin (≤2.4.20) allows unauthenticated network attackers to execute a
Stored cross-site scripting in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress (all versions
Stored Cross-Site Scripting in the Kali Forms WordPress plugin (versions up to and including 2.4.13) allows authenticate
Share
External POC / Exploit Code
Leaving vuln.today