Kali Forms CVE-2026-81276

The Kali Forms plugin must be installed and active on the target WordPress site running version 2.4.23 or earlier. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no special conditions beyond network reachability: no authentication is required, no non-default configuration must be present, and no victim interaction is needed. The specific endpoint(s) lacking authorization are not enumerated in the available intelligence, but CWE-862 and the 'Authentication Bypass' tag confirm that at least one plugin action is reachable without identity verification. Exploitation is constrained to integrity impact (I:L) - actions that would require higher privileges or affect confidentiality or availability are not implicated by the available data.

The CVSS 3.1 base score of 5.3 (Medium) is driven by the highly accessible attack surface (AV:N/AC:L/PR:N/UI:N) offset by the narrow impact (I:L only, C:N, A:N, S:U). EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified further. KEV status is negative and no public proof-of-concept has been identified at time of analysis, placing this in the lowest active-threat tier despite the unauthenticated vector. The real-world priority is moderate: the missing authorization pattern is trivially discoverable through manual plugin code review or automated WordPress scanning tooling, meaning even without a published exploit the vulnerability surface is thin. The bounded integrity-only impact limits blast radius - attackers cannot exfiltrate data or take the site offline via this vulnerability alone - but unauthorized form manipulation could enable phishing form substitution or data poisoning as a stepping stone.

An unauthenticated attacker sends a crafted HTTP POST request to a WordPress AJAX endpoint (wp-admin/admin-ajax.php or a REST route) exposed by the Kali Forms plugin, specifying an action or route that lacks capability verification. Because no nonce or role check is enforced, the server processes the request as if the caller were a privileged user, allowing the attacker to modify form configurations, inject malicious field definitions, or alter submission routing. No public proof-of-concept has been identified at time of analysis, but the attack pattern is standard for WordPress broken access control and requires no specialized tooling.