Kali Forms CVE-2026-11580

Exploitation requires a valid WordPress user account with at minimum Contributor-level access on the target site. The Kali Forms - Contact Form & Drag-and-Drop Builder plugin must be installed, active, and running a version prior to 2.4.17 - the post-duplication AJAX action is enabled by default upon plugin activation, so no special configuration is needed beyond standard installation. Exploitation is bounded by the requirement for a Contributor (or higher) account: unauthenticated visitors and lower-privilege roles (such as Subscriber) cannot trigger this action. The impact scope is limited to post metadata and secrets stored within the Kali Forms plugin's data structures; server-level secrets or credentials outside the WordPress database are not directly exposed. Sites where all user accounts are fully trusted or where Contributor role is not assigned to external parties are not materially at risk.

The vendor-provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N scores 5.5 (Medium), but this vector contains a significant discrepancy: it assigns PR:H (high privilege), whereas the CVE description explicitly states that Contributor-level access or above is sufficient. In WordPress, Contributor is a low-privilege role routinely granted to guest authors - this maps to PR:L, not PR:H. A corrected vector with PR:L yields approximately 7.1 (High), which better reflects actual risk. No EPSS data was provided; this absence should be noted. The vulnerability is not in CISA KEV, reducing urgency slightly, but a public proof-of-concept is confirmed by WPScan. The confidentiality impact of High is well-supported: private metadata and plugin-stored secrets (which may include API keys, form submission data, or configuration tokens) can be exfiltrated. Integrity impact is Low, reflecting that the attacker publishes a duplicate but cannot modify the original. Overall, this is a genuine medium-to-high priority issue on any multi-user WordPress site where untrusted contributors exist and the plugin is installed.

A publicly available proof-of-concept exists per WPScan. An attacker with a Contributor account on a WordPress site - such as a guest blogger or external content contributor - sends a crafted AJAX request to the Kali Forms post-duplication endpoint with the ID of a private post or form belonging to another user. The plugin duplicates the post and publishes it under the attacker's ownership without performing any ownership or visibility check, after which the attacker reads the duplicated post's metadata to extract secrets, API keys, or form configuration data embedded there by other plugin users.