WordPress security changelog
HIGH CVE-2026-16144 Received

Kali Forms reserved placeholders permit unauthenticated code execution

Kali Forms through 2.4.20 lets a submitted thisPermalink value replace a trusted callable placeholder and reach call_user_func() in _save_data(). An unauthenticated attacker can execute server-side code when the targeted form defines a field named thisPermalink, entryCounter or submission_link; the record does not identify the exact callable strings or request route.

CVE / CNA score 8.1 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Kali Forms — Contact Form & Drag-and-Drop Builder
Plugin slug
kali-forms
Affected
<= 2.4.20
Safe version
> 2.4.20
Published
Aug 01, 2026
Weakness
CWE-94 — Improper Control of Generation of Code ('Code Injection')

This CVE was published Aug 01, 2026 and is one of 14 known issues for this plugin.

What to do

Update, patch or deactivate.

Update to a corrected release after 2.4.20. Review forms for reserved field names, inspect submissions and host activity for callable payloads, rotate exposed secrets, and investigate the server if exploitation is suspected.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.

CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources