PT-2026-20289 · WordPress · Kali Forms
Youssef Elouaer
·
Publicado
2026-02-18
·
Atualizado
2026-02-18
·
CVE-2026-1860
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Kali Forms plugin for WordPress versions up to and including 2.4.8
Description
The software contains an Insecure Direct Object Reference issue. The
get items permissions check() permission callback on the /kaliforms/v1/forms/{id} API endpoint only verifies the edit posts capability, without confirming user ownership or authorization for the specific form resource. This allows authenticated attackers with Contributor-level access or higher to view form configuration data belonging to other users, including administrators, by identifying form IDs. Exposed data includes form field structures, Google reCAPTCHA secret keys (if configured), email notification templates, and server paths.Recommendations
Update Kali Forms plugin to a version later than 2.4.8.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Kali Forms