What is the CVSS score of CVE-2026-16144?

CVE-2026-16144 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Kali Forms are affected by CVE-2026-16144?

A remote code execution vulnerability in the Kali Forms WordPress plugin (versions 2.4.20 and earlier) allows attackers without authentication to execute arbitrary code on affected web servers…

How to fix or mitigate CVE-2026-16144?

Within 24 hours, audit all WordPress instances across the organization to identify installations of Kali Forms plugin version 2.4.20 or earlier and document affected systems. Within 7 days, immediately disable the Kali Forms plugin on all affected instances as an interim measure; if the plugin's functionality is critical, implement a Web Application Firewall rule to block POST requests to the vulnerable _save_data() endpoint and restrict form access to authenticated users only. Within 30 days, monitor the Kali Forms project for security updates and test any released patch thoroughly in a staging environment before production deployment; if no patch is released within 60 days, evaluate replacement plugins with active security maintenance and plan a full migration strategy.

Kali Forms CVE-2026-16144

EUVD-2026-51755 HIGH

Code Injection (CWE-94)

2026-08-01 Wordfence

GHSA-w9gv-h9qh-63cm

WordPress RCE Code Injection Kali Forms Contact Form Drag And Drop Builder Wordpress Plugin Wpchill

8.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

AV:N and PR:N because the form endpoint is publicly reachable with no authentication; AC:H because a specific non-default form field name matching a reserved key must be present for exploitation.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 08:52 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

HIGH 8.1

DescriptionCVE.org

The Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.

AnalysisAI

Remote code execution in the Kali Forms WordPress plugin (≤2.4.20) allows unauthenticated network attackers to execute arbitrary PHP on the server by submitting a crafted POST request to a vulnerable form. The _save_data() function fails to validate the 'thisPermalink' POST field before it overwrites a trusted callable placeholder, which is then passed unsanitized to call_user_func(). Exploitation is conditional on a specific form configuration (see exploitation_conditions), reflected in the CVSS AC:H rating; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in class-form-processor.php within the Kali Forms WordPress plugin (wpchill/kali-forms, CPE: cpe:2.3:a:wpchill:kali_forms_-_contact_form_&_drag-and-drop_builder:*:*:*:*:*:*:*:*). CWE-94 (Improper Control of Generation of Code) describes the root cause: the _save_data() function maintains a map of trusted callable placeholders and invokes them via PHP's call_user_func(). The check_if_placeholders_changed() gating function, which is meant to detect and reject attacker-supplied overrides of those placeholders, only inspects POST keys that are already present in the form's field_type_map. If a form administrator has named a field 'thisPermalink', 'entryCounter', or 'submission_link' - any of the three reserved keys - the attacker's POST value for that key bypasses the guard and is accepted as a valid callable, reaching call_user_func() without further sanitization. Source code evidence is publicly visible in the WordPress plugin SVN repository at the referenced line numbers in tags/2.4.19 and tags/2.4.20.

RemediationAI

Update the Kali Forms plugin to the version released after 2.4.20; a fix has been committed to the WordPress plugin repository per the changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3623024%40kali-forms&new=3623024%40kali-forms, though the exact fixed release version number is not independently confirmed in available data - install the current latest version from the WordPress plugin directory. As an immediate compensating control while patching is pending, audit all forms in the Kali Forms admin interface and rename any field whose internal name matches 'thisPermalink', 'entryCounter', or 'submission_link' - this eliminates the specific attack surface for this CVE since check_if_placeholders_changed() will no longer find attacker POST keys in the form's field_type_map. The trade-off is minimal: these field names have no user-facing significance and renaming them does not affect form functionality. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9d692aff-8bb2-45bb-9caf-bc33d3ed5b10?source=cve for additional guidance.