CVE-2026-16144 in Kali Forms Plugin
Summary
by MITRE • 08/01/2026
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/01/2026
The Kali Forms plugin for WordPress represents a widely used contact form solution that has been identified with a critical remote code execution vulnerability affecting all versions through 2.4.20. This vulnerability stems from inadequate input validation within the _save_data function, which creates a dangerous attack vector for unauthenticated adversaries seeking to compromise affected systems. The flaw specifically resides in how the plugin handles the 'thisPermalink' field value during form data processing, where attacker-controlled input can bypass security checks and reach the call_user_func() execution point.
The technical exploitation of this vulnerability requires a specific condition to be met within the target form configuration. Attackers must ensure that their malicious payload is injected into a form field whose name matches one of three reserved placeholder keys: 'thisPermalink', 'entryCounter', or 'submission_link'. This validation mechanism in check_if_placeholders_changed() only processes POST keys that exist within the form's field_type_map, creating a narrow but exploitable window for attackers. The vulnerability aligns with CWE-94, which describes improper control of generation of code, specifically when user-supplied data flows into execution functions without proper sanitization or validation.
From an operational perspective, this vulnerability presents a severe risk to WordPress installations using the affected plugin version, as it allows complete server compromise without authentication requirements. The remote code execution capability means attackers can execute arbitrary commands on the target system, potentially leading to data exfiltration, system takeover, or further network infiltration. The impact extends beyond immediate code execution to include potential privilege escalation and persistent backdoor establishment within the compromised environment.
Security mitigation strategies should prioritize immediate plugin updates to versions containing patches for this vulnerability, as recommended by the vendor and security advisories. Organizations should also implement network-level protections such as web application firewalls and access controls that can detect and block suspicious form submission patterns. The ATT&CK framework categorizes this vulnerability under T1059.001 - Command and Scripting Interpreter: PowerShell, as exploitation involves execution of malicious code on the target system through legitimate interpreter functions. Additional defensive measures include input sanitization at the application level, monitoring for unusual form processing activities, and regular security audits of third-party plugins to identify similar validation flaws that could lead to similar remote execution scenarios.