Kali Forms <= 2.4.20 — Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Kali Forms — Contact Form & Drag-and-Drop Builder.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 2.4.21, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Kali Forms — Contact Form & Drag-and-Drop Builder to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Wordfence PRISM.

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Jul 31, 2026

   CVE published

   Severity high, CVSS 8.1

2. Nov 13, 2026

   Record last updated