PT-2026-20289 · WordPress · Kali Forms
Youssef Elouaer
·
Published
2026-02-18
·
Updated
2026-02-18
·
CVE-2026-1860
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Kali Forms plugin for WordPress versions up to and including 2.4.8
Description
The software contains an Insecure Direct Object Reference issue. The
get items permissions check() permission callback on the /kaliforms/v1/forms/{id} API endpoint only verifies the edit posts capability, without confirming user ownership or authorization for the specific form resource. This allows authenticated attackers with Contributor-level access or higher to view form configuration data belonging to other users, including administrators, by identifying form IDs. Exposed data includes form field structures, Google reCAPTCHA secret keys (if configured), email notification templates, and server paths.Recommendations
Update Kali Forms plugin to a version later than 2.4.8.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kali Forms