EUVD-2026-44593
GHSA-mg5f-qx7f-gf9j
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Contributor access is PR:L in WordPress; AJAX endpoint is network-reachable with no interaction; C:H reflects secret metadata exfiltration, I:L reflects unauthorized post publication.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by other Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17.
AnalysisAI
Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.17 allows any authenticated Contributor-level (or higher) user to duplicate arbitrary posts they do not own by exploiting a missing per-object authorization check in the plugin's AJAX post-duplication action. The attacker gains a published copy of the target post under their own ownership and can extract private post metadata, including secrets stored by other Kali Forms instances on the same site. A publicly available proof-of-concept exists per WPScan; the vulnerability is not currently listed in the CISA KEV catalog, though the low privilege bar and default-enabled feature make it an actionable risk on any multi-user WordPress installation running the affected plugin.
Technical ContextAI
The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class root cause where the application performs a capability check at the action level ('can this user duplicate posts?') but omits the per-object check ('does this user have the right to access this specific post?'). The Kali Forms plugin registers a WordPress AJAX handler for its post-duplication feature; when invoked, it accepts an arbitrary post ID supplied by the client without verifying the requesting user's relationship to that specific post. This allows any Contributor (who normally cannot read private posts or posts owned by others) to supply any post ID and receive a duplicate with its metadata intact. The affected product per CPE is cpe:2.3:a:unknown:kali_forms_-_contact_form_&_drag-and-drop_builder:*:*:*:*:*:*:*:* covering all versions before 2.4.17. WordPress's object-level access control (post ownership, post status visibility) is entirely bypassed at this AJAX endpoint.
RemediationAI
Upgrade the Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin to version 2.4.17 or later, which introduces the missing per-object capability check in the AJAX post-duplication handler. The patch is confirmed available from the vendor per WPScan advisory https://wpscan.com/vulnerability/d73500e1-a8bc-4d31-ad9b-d1f71212bcc7/ and VulDB https://vuldb.com/vuln/379198. If immediate patching is not feasible, reduce the Contributor role assignment to only fully trusted users, as this eliminates the attack surface for external or low-trust contributors - note this may restrict legitimate editorial workflows. Alternatively, if the Kali Forms plugin offers a setting to disable the post-duplication feature, disabling it removes the vulnerable AJAX action at the cost of losing duplication functionality for all users. Rotating any secrets (API keys, tokens) stored in Kali Forms post metadata is advisable on sites with untrusted Contributor-level accounts, as prior exposure cannot be ruled out.
The Kali Forms plugin for WordPress contains a critical remote code execution vulnerability that allows unauthenticated
Stored cross-site scripting in the Kali Forms WordPress plugin (before 2.4.13) allows Contributor-level users to inject
Unauthenticated file upload to the WordPress Media Library is possible in Kali Forms - Contact Form & Drag-and-Drop Buil
Remote code execution in the Kali Forms WordPress plugin (≤2.4.20) allows unauthenticated network attackers to execute a
Stored cross-site scripting in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress (all versions
Stored Cross-Site Scripting in the Kali Forms WordPress plugin (versions up to and including 2.4.13) allows authenticate
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today