Insecure Direct Object Reference in Kali Forms Plugin for WordPress

CVE-2026-1860

What is CVE-2026-1860?

The Kali Forms plugin for WordPress is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability in the REST API endpoint handling form data. This flaw arises because the permission check in the get_items_permissions_check() function only verifies whether the user has the edit_posts capability, without confirming ownership or specific authorization for the requested form resource. As a result, authenticated users with Contributor-level access or higher can potentially access sensitive configuration data for forms belonging to other users, including administrators. The exposed information may comprise form field structures, Google reCAPTCHA secret keys, email notification templates, and server paths, placing user data at risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References