CVE-2026-16144
Received Received - Intake

Remote Code Execution in Kali Forms WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-16144
EUVD
EUVD-2026-51755

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpforms kaliforms to 2.4.20 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Remote Code Execution vulnerability in the Kali Forms WordPress plugin up to version 2.4.20. It occurs in the _save_data function due to insufficient validation of the 'thisPermalink' field. Attackers can exploit this by providing malicious input that bypasses placeholder checks, allowing unauthenticated code execution on the server.

Detection Guidance

This vulnerability requires checking for the Kali Forms plugin versions up to 2.4.20 in WordPress installations. Inspect plugin files for the _save_data function and verify if the 'thisPermalink' field is improperly validated. No specific commands are provided in the context.

Impact Analysis

An attacker could gain full control of your WordPress server, steal sensitive data, install malware, or use the compromised site to attack other systems. Since it requires no authentication, any unpatched site is at immediate risk if forms use reserved placeholder keys.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and breach notification. Organizations may face fines, legal action, and reputational damage if exploited.

Mitigation Strategies

Immediately update the Kali Forms plugin to the latest version beyond 2.4.20. If an update is unavailable, disable or remove the plugin until a patch is released. Review WordPress forms for reserved placeholder fields and restrict unauthenticated access to form submission endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart