Technical impact
This vulnerability allows an attacker to supply a crafted value for the field named 'thisPermalink' which bypasses normal validation and is then passed directly to PHP’s call_user_func() routine inside the plugin’s _save_data() function. The uncontrolled function call enables the execution of arbitrary PHP code on the host, compromising the confidentiality, integrity, and availability of the entire server environment. The weakness is classified as CWE-94: Improper Control of Function or Method Invocation.
Affected Systems
The issue is present in all releases of the Kali Forms – Contact Form & Drag-and-Drop Builder plugin up to version 2.4.20, which is used on WordPress sites. Any installation that includes a form field with a name matching one of the reserved placeholder keys (thisPermalink, entryCounter, or submission_link) is vulnerable. No specific WordPress core or PHP version is required for exploitation beyond the normal plugin deployment.
Risk and Exploitability
The CVSS score of 8.1 indicates high impact and medium to high exploitability. The EPSS score is less than 1%, implying the current probability of exploitation is low, and the vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Nevertheless, because unauthenticated attackers can trigger the flaw simply by sending a specially crafted POST request to a vulnerable form, the risk is notable for sites that allow public form access.
