Remote Code Execution Vulnerability in Kali Forms Plugin by WordPress
CVE-2026-16144

8.1HIGH

Key Information:

Vendor

WordPress
Status
Kali Forms — Contact Form & Drag-and-drop Builder
Vendor
CVE Published:
1 August 2026

What is CVE-2026-16144?

The Kali Forms plugin for WordPress has a vulnerability in its _save_data function that allows unauthenticated users to execute arbitrary code on the server. This occurs due to inadequate validation of the 'thisPermalink' field, which can overwrite a trusted callable placeholder. Specifically, when a form is configured with certain reserved placeholder names, attacker-controlled input can reach the call_user_func() function, enabling unauthorized code execution. It is essential for users to upgrade to version 2.4.21 or higher to mitigate this risk effectively.

Affected Version(s)

Kali Forms — Contact Form & Drag-and-Drop Builder 0 <= 2.4.20

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/kali-forms/tag...
https://plugins.trac.wordpress.org/browser/kali-forms/tag...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.