Kali Forms: Code execution
Kali Forms is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
- Component
- Kali Forms
- Plugin slug
kali-forms- Affected
- See vendor advisory
- Safe version
- See mitigation notes
- Published
- Mar 20, 2026
This CVE was published Mar 20, 2026 and is one of 12 known issues for this plugin.
Patch or disable the affected component.
Update Kali Forms to a release outside the affected range, or disable and remove it until a fixed version is available.
Technical description
The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H