WordPress Vulnerability Listing

HighCVE-2026-16144

Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter

Kali Forms — Contact Form & Drag-and-Drop Builder: Currently marked unpatched

Affected versions: *-2.4.20

Vulnerability type: CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected software, patched versions and attribution

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.

Kali Forms — Contact Form & Drag-and-Drop Builder

Affected versions: *-2.4.20

Patched versions: 2.4.21

Researcher credit: Wordfence PRISM

Applicable copyright and licence notices

This record contains material that is subject to copyright

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

18 vulnerability records

Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter

Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting

Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.18 - Authenticated (Subscriber+) Arbitrary File Deletion

Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value

Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter

Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms <= 2.4.16 - Authenticated (Contributor+) Insecure Direct Object Reference to Post Metadata Disclosure

Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms <= 2.4.16 - Missing Authorization to Unauthenticated Media File Upload

Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process

Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure

Kali Forms — Contact Form & Drag-and-Drop Builder

Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Kali Forms — Contact Form & Drag-and-Drop Builder

Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation

Kali Forms — Contact Form & Drag-and-Drop Builder

Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization

Kali Forms — Contact Form & Drag-and-Drop Builder

Contact Form builder with drag & drop - Kali Forms <= 2.3.36 - Insecure Direct Object Reference

Kali Forms — Contact Form & Drag-and-Drop Builder

Contact Form builder with drag & drop - Kali Forms <= 2.3.27 - Missing Authorization via Contact Form

Kali Forms — Contact Form & Drag-and-Drop Builder

Contact Form builder with drag & drop - Kali Forms <= 2.3.28 - Missing Authorization via get_log

Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion

Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms <= 2.1.1 - Missing Authorization to Settings Update

Kali Forms — Contact Form & Drag-and-Drop Builder

Kali Forms <= 2.1.1 - Cross-Site Request Forgery

Kali Forms — Contact Form & Drag-and-Drop Builder