Kali Forms Contact Form Drag And Drop Builder EUVD-2026-13814

Kali Forms plugin for WordPress versions up to 2.4.9 must be installed and activated. The vulnerable 'form_process' function processes user-supplied form submissions. Remote unauthenticated attackers can exploit this via crafted form data without user interaction or authentication.

This vulnerability presents critical real-world risk based on multiple converging factors. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates maximum severity: network-accessible, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is trivially exploitable by unauthenticated attackers, making it fully automatable for mass exploitation. WordPress plugins have a broad attack surface with potentially millions of installations, and RCE vulnerabilities in this context typically see rapid exploitation attempts. The availability of patch information in the WordPress plugin repository (changeset 3487024) and detailed code references suggests the vulnerability has been analyzed and fixed, increasing the likelihood that exploit code or proof-of-concept exists or will soon emerge. This is an unambiguous priority for immediate patching given the combination of trivial exploitation, no authentication requirement, and complete system compromise potential.

An unauthenticated remote attacker crafts a malicious HTTP POST request to a WordPress site running the vulnerable Kali Forms plugin, embedding specially crafted parameter names that map to PHP functions like 'system', 'exec', or 'shell_exec' along with command arguments as values. When the form_process function processes this request, the prepare_post_data function stores these attacker-controlled values as placeholders, which are then passed directly to call_user_func, executing the attacker's arbitrary code with web server privileges. The attacker gains immediate remote code execution capability, allowing them to install web shells, exfiltrate sensitive data including database credentials, pivot to other systems, or fully compromise the WordPress installation and underlying server infrastructure.