Kali Forms CVE-2026-59542

Requires an authenticated session at Subscriber level or higher (CVSS PR:L), so the practical prerequisite is either that the target site has open user registration enabled - allowing anyone to self-provision a Subscriber account - or that the attacker already holds any low-privilege credential. The vulnerable code path is the Kali Forms file-deletion functionality, reachable over the network (AV:N) with no user interaction and low attack complexity. Limiting factors: the attack cannot be performed fully unauthenticated (a valid login is mandatory), and on sites that disable public registration and provision accounts only for vetted users the attack surface is substantially reduced; the impact is destructive (file deletion / denial of service) rather than data disclosure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, base 7.7 High) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change and High availability impact - consistent with deleting files outside the plugin's own component to disable the whole site. Real-world risk hinges primarily on one deployment factor: whether the site permits open user registration (Subscriber accounts). On registration-open sites the barrier is trivial; where accounts are provisioned only for vetted staff the attacker must first obtain any authenticated session. No EPSS score, KEV entry, or POC was supplied in the input, so exploitation probability cannot be quantified - the absence of these signals suggests this is not yet subject to mass automated exploitation, but path-traversal delete bugs in WordPress plugins are historically easy to weaponize once details are public. The impact is confined to availability (C:N/I:N/A:H): it destroys/denies rather than exfiltrates data, though deleting wp-config.php can indirectly enable a takeover-via-reinstall path in some scenarios.

An attacker registers a free Subscriber account (or uses any existing low-privilege login) on a WordPress site running Kali Forms <= 2.4.18, then sends a crafted authenticated request to the plugin's file-deletion handler with a traversal path such as ../../../wp-config.php. The server deletes the targeted file, taking the site offline or forcing it into a fresh-install state. No public exploit code is identified in the source data, but the low complexity (AC:L) and lack of required user interaction make weaponization straightforward.