PT-2026-26682 · WordPress · Kali Forms

Ismailshadow

·

Publicado

2026-03-20

·

Atualizado

2026-04-14

·

CVE-2026-3584

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Kali Forms versions prior to 2.4.9
Description The Kali Forms plugin for WordPress is susceptible to Remote Code Execution in versions up to and including 2.4.9. This is due to the prepare post data function mapping user-supplied keys directly into internal placeholder storage, combined with the use of call user func on these placeholder values. This allows unauthenticated attackers to execute code on the server. The vulnerability is triggered via the form process function. The issue involves user-controlled placeholders and the call user func function, which can lead to unauthorized code execution.
Recommendations Versions prior to 2.4.9 should be updated.

Correção

RCE

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-3584

Produtos afetados

Kali Forms