CVE-2026-3584

Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process

View on CVE.org
Published Mar 20, 2026 CVSS 3.1 · 9.8 Critical EPSS 7.4% KEV · Not listed
Description
The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.

Analysis

AI-generated

Technical impact

The Kali Forms plugin for WordPress contains a flaw in the form_process routine where user supplied data is mapped directly to internal placeholders and later executed via call_user_func, enabling the execution of arbitrary code on the server without authentication. This flaw is a code injection vulnerability (CWE‑94) that allows attackers to run arbitrary PHP code.

Affected Systems

This vulnerability affects WordPress installations using the Kali Forms plugin by wpchill, specifically versions 2.4.9 and earlier.

Risk and Exploitability

The CVSS base score is 9.8, indicating critical severity, and the EPSS score of 7% indicates a higher likelihood of exploitation. The lack of KEV listing does not mitigate the fact that unauthenticated attackers can submit malicious input through the form processing endpoint to achieve full application compromise. The likely attack vector is a remotely crafted HTTP request to the form_process URL with controlled parameters.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Kali Forms to the latest release that fixes the vulnerable code (any version newer than 2.4.9).
  • If an immediate update is not feasible, disable or remove the Kali Forms plugin to eliminate the risk.
  • Verify that no custom form processing code remains in the theme that could re‑introduce the vulnerability.
  • After applying the fix or removal, monitor the site for any unauthorized activity.

Generated by OpenCVE AI on October 25, 2026 at 21:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpchill
Wpchill kali Forms — Contact Form & Drag-and-drop Builder
Vendors & Products Wordpress
Wordpress wordpress
Wpchill
Wpchill kali Forms — Contact Form & Drag-and-drop Builder
Type Values Removed Values Added
Description The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.
Title Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 8, 2026, 4:59 PM
Reserved
Mar 5, 2026, 5:20 AM

View source JSON

Updated
Mar 23, 2026, 4:51 PM

JSON

Status
Deferred
Published
Mar 20, 2026, 10:16 PM
Modified
Jun 17, 2026, 10:43 AM

View source JSON

No data.

Updated
Oct 25, 2026, 9:30 PM

JSON