What is the CVSS score of CVE-2026-3584?

CVE-2026-3584 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WordPress are affected by CVE-2026-3584?

A critical remote code execution vulnerability in the Kali Forms WordPress plugin (CVE-2026-3584, CVSS 9.8) allows attackers to execute malicious code on affected servers without authentication.

Is there a public PoC exploit available for CVE-2026-3584?

Yes, a public proof-of-concept exploit is available for CVE-2026-3584. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-3584?

Within 24 hours: Audit all WordPress instances for Kali Forms plugin presence and version; immediately disable the plugin on affected sites if no patch is available. Within 7 days: Evaluate alternative form builder plugins and plan migration strategy; implement Web Application Firewall rules to block exploitation attempts. Within 30 days: Complete migration to patched or alternative solutions; conduct full security audit of affected systems for signs of compromise.

WordPress CVE-2026-3584

EUVD-2026-13814 CRITICAL

Code Injection (CWE-94)

2026-03-20 Wordfence

WordPress RCE Code Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

PoC Detected

Mar 23, 2026 - 14:32 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 21:31 euvd

EUVD-2026-13814

Analysis Generated

Mar 20, 2026 - 21:31 vuln.today

CVE Published

Mar 20, 2026 - 21:25 nvd

CRITICAL 9.8

DescriptionCVE.org

The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.

Articles & Coverage 1

POC CVE-2026-3584: Kali Forms <= 2.4.9 Unauthenticated RCE & Privilege Escalation Mar 25, 2026

AnalysisAI

The Kali Forms plugin for WordPress contains a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code on the server. All versions up to and including 2.4.9 are affected, including the popular 'Kali Forms - Contact Form & Drag-and-Drop Builder' plugin by WPChill. The vulnerability carries a critical CVSS score of 9.8 due to its network-based attack vector, low complexity, and lack of required authentication or user interaction.

Technical ContextAI

This vulnerability affects the Kali Forms plugin (CPE: cpe:2.3:a:wpchill:kali_forms_—_contact_form_&_drag-and-drop_builder:*:*:*:*:*:*:*:*), specifically in the form_processor.php file's 'form_process' function. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection), where the 'prepare_post_data' function maps user-supplied keys directly into internal placeholder storage without proper sanitization. These placeholder values are subsequently passed to PHP's 'call_user_func' function, which interprets them as callable functions or methods. This creates a direct path from untrusted user input to code execution, representing a textbook code injection vulnerability in a WordPress plugin context.

RemediationAI

Immediately update the Kali Forms plugin to version 2.4.10 or later, which addresses this vulnerability as documented in WordPress plugin changeset 3487024 available at https://plugins.trac.wordpress.org/changeset/3487024/kali-forms. Site administrators should verify the plugin version in the WordPress dashboard and apply updates immediately. Until patching is complete, consider temporarily disabling the Kali Forms plugin if it is not business-critical, or implement web application firewall (WAF) rules to block suspicious requests to the form_process endpoint. Review server logs for any signs of exploitation attempts targeting this vulnerability, particularly POST requests with unusual parameter names that might represent function calls. After patching, conduct a security audit to ensure no unauthorized code or backdoors were installed if the site was potentially compromised.