Description
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.
Published: 2026-08-01
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability allows an attacker to supply a crafted value for the field named 'thisPermalink' which bypasses normal validation and is then passed directly to PHP’s call_user_func() routine inside the plugin’s _save_data() function. The uncontrolled function call enables the execution of arbitrary PHP code on the host, compromising the confidentiality, integrity, and availability of the entire server environment. The weakness is classified as CWE-94: Improper Control of Function or Method Invocation.

Affected Systems

The issue is present in all releases of the Kali Forms – Contact Form & Drag-and-Drop Builder plugin up to version 2.4.20, which is used on WordPress sites. Any installation that includes a form field with a name matching one of the reserved placeholder keys (thisPermalink, entryCounter, or submission_link) is vulnerable. No specific WordPress core or PHP version is required for exploitation beyond the normal plugin deployment.

Risk and Exploitability

The CVSS score of 8.1 indicates high impact and medium to high exploitability. The EPSS score is less than 1%, implying the current probability of exploitation is low, and the vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Nevertheless, because unauthenticated attackers can trigger the flaw simply by sending a specially crafted POST request to a vulnerable form, the risk is notable for sites that allow public form access.

Generated by OpenCVE AI on August 2, 2026 at 03:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Kali Forms to a version newer than 2.4.20, which removes the insecure use of call_user_func() in form processing.
  • If an immediate upgrade is not possible, temporarily disable or delete the plugin and restrict access to any form pages until a patch is applied.
  • Avoid creating form fields with names that match the reserved placeholder keys; rename or remove such fields to eliminate the route that leads to the vulnerable code path.

Generated by OpenCVE AI on August 2, 2026 at 03:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 01 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpchill
Wpchill kali Forms — Contact Form & Drag-and-drop Builder
Vendors & Products Wordpress
Wordpress wordpress
Wpchill
Wpchill kali Forms — Contact Form & Drag-and-drop Builder

Sat, 01 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Description The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.
Title Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Wordpress Wordpress
Wpchill Kali Forms — Contact Form & Drag-and-drop Builder
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-03T19:22:40.521Z

Reserved: 2026-07-17T17:45:06.586Z

Link: CVE-2026-16144

cve-icon Vulnrichment

Updated: 2026-08-03T19:22:37.043Z

cve-icon NVD

Status : Deferred

Published: 2026-08-01T09:17:00.690

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-16144

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T03:30:14Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')