Kali Forms CVE-2026-11581

Exploitation requires the attacker to possess at minimum a WordPress Contributor-level account on the target installation - this is the critical prerequisite. The attack is not exploitable by unauthenticated visitors. The target site must have the Kali Forms plugin installed and active in a version prior to 2.4.13. A second condition for the full chain is that an administrator must load the form-entries admin screen after the malicious form is published; the missing capability check allows the attacker to trigger publication independently, removing the need for the admin to organically discover and publish the form. Environments where Contributor registration is open to the public (e.g., sites with open user registration at the Contributor role) face substantially higher risk than those where Contributors are vetted individuals. No special server configuration or non-default WordPress setting is required beyond the plugin being active.

The provided CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L scoring 5.9, but PR:H (High Privileges) appears inconsistent with the description, which explicitly names Contributor-level access as sufficient - Contributors are low-privilege WordPress users, not high-privilege operators. This metric discrepancy should be verified with the vendor; PR:L is the more defensible assignment and would raise the base score. The scope change (S:C) correctly reflects XSS crossing into the admin session. UI:R accurately captures the requirement that an admin must load the entries page. Real-world risk is meaningfully elevated by the chained missing capability check: without it, an attacker would need to wait for an admin to publish the form; with it, the attacker controls the publication step, shortening the attack chain significantly. A publicly available proof-of-concept exists via WPScan, lowering the technical barrier. No EPSS data was supplied and no KEV listing exists, suggesting exploitation is not yet widespread, but the low attack complexity and accessible PoC make opportunistic targeting plausible on multi-tenant or shared WordPress environments where Contributor accounts are granted to untrusted users.

An attacker who holds a Contributor account on the target WordPress site creates a new Kali Forms contact form and injects a JavaScript payload (e.g., a session cookie exfiltration script) into a form field's caption. The attacker then invokes the plugin's post-duplication action - which lacks a proper capability check - to publish the form without administrator approval. When a site administrator next navigates to the form-entries screen to review submissions, the caption renders as a column header and the stored script executes in the admin's browser, potentially exfiltrating session cookies, creating rogue admin accounts, or performing arbitrary WordPress admin actions. A publicly available PoC via WPScan reduces the skill required to execute this chain.