EUVD-2026-48195
GHSA-f785-j866-927f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Network-reachable authenticated action (PR:L for a Subscriber), low complexity, no user interaction; deleting files outside the plugin (e.g. wp-config.php) justifies S:C and A:H with no confidentiality or integrity impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.
AnalysisAI
Arbitrary file deletion in the Kali Forms WordPress plugin (versions 2.4.18 and earlier) lets a low-privileged authenticated user - as low as a Subscriber - delete arbitrary files on the server via path traversal. On sites that allow open registration, an attacker can self-provision an account and remove critical files such as wp-config.php, knocking the site offline or forcing it into a fresh-install state. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
Technical ContextAI
Kali Forms is a drag-and-drop form-builder plugin for WordPress (vendor namespace wp_chill / WP Chill) used to create contact, subscription, and payment forms. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): a file-handling routine - typically a form attachment/upload deletion handler exposed through admin-ajax.php or the WordPress REST API - accepts a user-controlled filename or path and passes it to a filesystem delete operation without normalizing or constraining it to the intended directory. By supplying traversal sequences (e.g. ../../), the caller escapes the plugin's upload directory and deletes files anywhere the PHP/web-server process can write, including WordPress core files. The CPE cpe:2.3:a:wp_chill:kali_forms:*:*:*:*:*:*:*:* confirms all versions up to and including 2.4.18 are in scope.
RemediationAI
Update Kali Forms to the first fixed release above 2.4.18 as published by the vendor; the exact patched version is not included in the provided data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/kali-forms/vulnerability/wordpress-kali-forms-plugin-2-4-18-arbitrary-file-deletion-vulnerability) and the plugin changelog on WordPress.org to confirm the fixed version before deploying. Until patched, disable open user registration (Settings > General > uncheck 'Anyone can register') so untrusted accounts cannot reach the vulnerable authenticated action - trade-off: blocks legitimate self-service signup. As additional compensating controls, apply a WAF/virtual patch (Patchstack offers virtual patching) to block path-traversal payloads (../ sequences) sent to admin-ajax.php and REST routes; deactivate the Kali Forms plugin entirely if it is not business-critical (trade-off: forms stop working); and enforce least-privilege filesystem permissions for the web-server/PHP user so core files cannot be deleted, while keeping tested backups to recover from any file destruction.
More in Kali Forms
View allThe Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1.
The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and incl
The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.
Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for Wo
Broken access control in the Kali Forms WordPress plugin (versions ≤ 2.4.23) exposes one or more plugin endpoints to una
The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today