EUVD-2026-44592
GHSA-56gf-mrhh-4cwv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with active Kali Forms plugin
-
DeliverySend unauthenticated POST to plugin upload endpoint
-
ExploitBypass missing form-context validation
-
ExecutionUpload WordPress-allowed MIME type file
-
PersistFile persists in publicly accessible Media Library
-
ImpactUse stored file URL for content injection or phishing
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required to trigger the upload - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against any WordPress installation with the Kali Forms plugin installed and active on a version below 2.4.17, regardless of whether any contact form has ever been created or published on the site. The critical limiting factor is WordPress's built-in MIME type allowlist: only file types WordPress considers safe (images such as JPEG/PNG/GIF, PDFs, common document formats) can be uploaded, which categorically prevents uploading PHP scripts, executables, or other dangerous file types through this vector. Exploitation is therefore constrained to media library pollution with non-executable content; a site with no public-facing forms, or with the plugin installed but inactive, is not vulnerable via this path. |
| Impact | The NVD-assigned CVSS 3.1 score of 5.3 Medium with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N is well-calibrated for this vulnerability. Attack complexity is genuinely low and no privileges are required, but the impact ceiling is hard-capped at low integrity by WordPress's MIME allowlist - confidentiality and availability are unaffected. There is no CISA KEV entry, so confirmed active exploitation in the wild is not established by the available data. However, the public availability of a WPScan proof-of-concept substantially lowers the exploitation barrier, meaning opportunistic abuse is plausible. The practical real-world risk is unauthorized media library pollution (unwanted images, PDFs, or documents deposited on the site), which could be leveraged for content injection, phishing page staging, or storage quota abuse - not server compromise. The gap between the tags listing 'RCE' and the description explicitly ruling out code execution should be noted: the RCE tag appears to be a misclassification; no code execution path exists via this vector given the MIME restriction. |
| Exploit ScenarioDerived | An unauthenticated attacker, using the publicly available WPScan proof-of-concept, sends a crafted HTTP POST request directly to the Kali Forms file upload endpoint on any WordPress site running a vulnerable plugin version, without supplying any valid form ID or session context. The server accepts the request and stores the submitted file - for example, a deceptive image or a malicious PDF designed to exploit document readers - directly in the WordPress Media Library, from which it becomes publicly accessible via a predictable URL for use in phishing or content injection campaigns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Unauthenticated file upload to the WordPress Media Library is possible in Kali Forms - Contact Form & Drag-and-Drop Builder versions before 2.4.17, because the plugin's upload handler accepts file submissions without verifying that a corresponding form with a file-upload field actually exists on the site. Any unauthenticated remote attacker can directly invoke the upload endpoint and deposit files into the Media Library. Impact is bounded by WordPress's core MIME type allowlist, which prevents upload of executable files and thereby rules out code execution; a publicly available proof-of-concept is confirmed by WPScan, and no CISA KEV listing is present at time of analysis.
RemediationAI
Update the Kali Forms plugin to version 2.4.17 or later, which introduces the missing server-side validation ensuring file uploads are only accepted when the request corresponds to an existing, properly configured form that includes a file-upload field. The vendor-released patch is confirmed available and should be applied promptly given the existence of public exploit code. As a compensating control while patching is pending, administrators may deactivate the Kali Forms plugin entirely to eliminate the exposed endpoint - the trade-off being loss of all contact form functionality. Alternatively, a Web Application Firewall rule blocking POST requests to the plugin's file upload handler path can mitigate exploitation with minimal site impact. Auditing the WordPress Media Library for unexpected file uploads after the patch is applied is advisable to identify any files deposited prior to remediation. References: https://wpscan.com/vulnerability/fae38fd0-8183-4864-8dae-0cd33a220bec/ and https://vuldb.com/vuln/379197.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kali Forms is a WordPress contact form and drag-and-drop builder plugin (CPE: cpe:2.3:a:unknown:kali_forms_-_contact_form_&_drag-and-drop_builder). The root cause maps to CWE-434 (Unrestricted Upload of File with Dangerous Type), though the practical severity is attenuated because WordPress enforces a global MIME type allowlist at the core level, blocking PHP and other executable extensions. The design flaw is a missing server-side gate: the file upload handler is fully decoupled from the form lifecycle - it never queries whether a form with a file-upload field configuration actually exists before accepting and persisting the uploaded file. This makes the endpoint behave as an open, context-free file ingestion point accessible to any HTTP client, rather than a controlled upload handler scoped to legitimate form submissions.
Know when Kali Forms Contact Form Drag And Drop Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable endpoint requires no authentication or user interaction; integrity impact is low as WordPress's MIME allowlist caps uploads to safe file types, with no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload files to the WordPress Media Library; the uploads are limited to WordPress's default-allowed MIME types, so this does not lead to code execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The Kali Forms plugin for WordPress contains a critical remote code execution vulnerability that allows unauthenticated
Stored cross-site scripting in the Kali Forms WordPress plugin (before 2.4.13) allows Contributor-level users to inject
Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.17 allows any authenticated Contri
Email address disclosure in Kali Forms versions before 2.4.30 allows authenticated Subscriber-level users to retrieve th
Kali Forms versions before 2.4.30 expose its test-email handler to any authenticated user, allowing a Subscriber-level a
Remote code execution in the Kali Forms WordPress plugin (≤2.4.20) allows unauthenticated network attackers to execute a
Stored cross-site scripting in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress (all versions
Stored Cross-Site Scripting in the Kali Forms WordPress plugin (versions up to and including 2.4.13) allows authenticate
Exploit-DB