EUVD-2026-51755
GHSA-w9gv-h9qh-63cm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Kali Forms ≤2.4.20
-
DeliveryEnumerate forms to find reserved placeholder field name
-
ExploitCraft POST request with malicious PHP callable in matching field
-
Executioncheck_if_placeholders_changed() passes attacker value into placeholder map
-
Persist_save_data() invokes attacker callable via call_user_func()
-
ImpactArbitrary code executes as web server process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two concurrent conditions: (1) the target WordPress site must be running Kali Forms plugin version 2.4.20 or earlier, and (2) at least one publicly accessible form on that site must have a field whose internal name exactly matches one of three reserved placeholder keys - 'thisPermalink', 'entryCounter', or 'submission_link' - because check_if_placeholders_changed() only processes POST keys that appear in the form's field_type_map. If no form on the site uses these specific field names, the vulnerable code path in _save_data() cannot be reached by attacker-controlled input, and the site is not exploitable despite running a vulnerable plugin version. No authentication is required once these configuration conditions are met (PR:N per CVSS). The limiting factor is the form field naming requirement, which is non-default but possible for administrators who unknowingly chose a reserved keyword as a field identifier. |
| Impact | The CVSS 8.1 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H accurately represents the risk profile: full impact triad (C:H/I:H/A:H) with no authentication or user interaction required, but AC:H correctly flags that a specific non-default form configuration must be present. This is not a universal spray-and-pray vulnerability - an attacker must first confirm that a target form uses one of three reserved field names. Sites where no form uses those exact names are not exploitable despite running vulnerable plugin versions. No EPSS score was provided in the input data. No CISA KEV listing is present, and no standalone public exploit code has been identified; references point to source code browser links showing the vulnerable logic rather than weaponized PoC. The Wordfence changeset reference indicates a fix has been committed, which typically precedes broader exploitation campaigns. Real-world priority should be elevated for any site that has forms with these reserved field names, and moderate for all other Kali Forms deployments pending patching. |
| Exploit ScenarioDerived | An attacker scans a target WordPress site and confirms it is running Kali Forms ≤2.4.20; through form field inspection or enumeration, the attacker identifies a public-facing form where a field is named 'thisPermalink'. The attacker submits a crafted HTTP POST to the form's submission endpoint with the 'thisPermalink' parameter set to a PHP callable such as 'system', paired with a command argument, causing call_user_func() in _save_data() to invoke the operating system command as the web server process user. No authentication is required, and no exploit code needs to be uploaded - the attack is delivered entirely via a standard form submission request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 01, 2026
Remote code execution in the Kali Forms WordPress plugin (≤2.4.20) allows unauthenticated network attackers to execute arbitrary PHP on the server by submitting a crafted POST request to a vulnerable form. The _save_data() function fails to validate the 'thisPermalink' POST field before it overwrites a trusted callable placeholder, which is then passed unsanitized to call_user_func(). Exploitation is conditional on a specific form configuration (see exploitation_conditions), reflected in the CVSS AC:H rating; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Update the Kali Forms plugin to the version released after 2.4.20; a fix has been committed to the WordPress plugin repository per the changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3623024%40kali-forms&new=3623024%40kali-forms, though the exact fixed release version number is not independently confirmed in available data - install the current latest version from the WordPress plugin directory. As an immediate compensating control while patching is pending, audit all forms in the Kali Forms admin interface and rename any field whose internal name matches 'thisPermalink', 'entryCounter', or 'submission_link' - this eliminates the specific attack surface for this CVE since check_if_placeholders_changed() will no longer find attacker POST keys in the form's field_type_map. The trade-off is minimal: these field names have no user-facing significance and renaming them does not affect form functionality. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9d692aff-8bb2-45bb-9caf-bc33d3ed5b10?source=cve for additional guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in class-form-processor.php within the Kali Forms WordPress plugin (wpchill/kali-forms, CPE: cpe:2.3:a:wpchill:kali_forms_-_contact_form_&_drag-and-drop_builder:*:*:*:*:*:*:*:*). CWE-94 (Improper Control of Generation of Code) describes the root cause: the _save_data() function maintains a map of trusted callable placeholders and invokes them via PHP's call_user_func(). The check_if_placeholders_changed() gating function, which is meant to detect and reject attacker-supplied overrides of those placeholders, only inspects POST keys that are already present in the form's field_type_map. If a form administrator has named a field 'thisPermalink', 'entryCounter', or 'submission_link' - any of the three reserved keys - the attacker's POST value for that key bypasses the guard and is accepted as a valid callable, reaching call_user_func() without further sanitization. Source code evidence is publicly visible in the WordPress plugin SVN repository at the referenced line numbers in tags/2.4.19 and tags/2.4.20.
Know when Kali Forms Contact Form Drag And Drop Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N and PR:N because the form endpoint is publicly reachable with no authentication; AC:H because a specific non-default form field name matching a reserved key must be present for exploitation.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.
Executive ViewAI
A remote code execution vulnerability in the Kali Forms WordPress plugin (versions 2.4.20 and earlier) allows attackers without authentication to execute arbitrary code on affected web servers through a malformed form submission. Any organization running this plugin faces risk of server compromise, data theft, and lateral movement within their infrastructure, with severity amplified for companies using WordPress as their primary web platform.
Disable Kali Forms plugin entirely pending vendor patch availability. If operational necessity requires the plugin remain active, implement Web Application Firewall rules to block POST requests to form endpoints and restrict form access to authenticated users; additionally, monitor server logs and form submissions for suspicious POST payloads targeting the thisPermalink parameter.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The Kali Forms plugin for WordPress contains a critical remote code execution vulnerability that allows unauthenticated
Stored cross-site scripting in the Kali Forms WordPress plugin (before 2.4.13) allows Contributor-level users to inject
Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.17 allows any authenticated Contri
Unauthenticated file upload to the WordPress Media Library is possible in Kali Forms - Contact Form & Drag-and-Drop Buil
Email address disclosure in Kali Forms versions before 2.4.30 allows authenticated Subscriber-level users to retrieve th
Kali Forms versions before 2.4.30 expose its test-email handler to any authenticated user, allowing a Subscriber-level a
Stored cross-site scripting in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress (all versions
Stored Cross-Site Scripting in the Kali Forms WordPress plugin (versions up to and including 2.4.13) allows authenticate
Exploit-DB