PT-2026-26682 · WordPress · Kali Forms

Ismailshadow · Published 2026-03-20 · Updated 2026-04-14 · CVE-2026-3584

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kali Forms versions prior to 2.4.9

Description The Kali Forms plugin for WordPress is susceptible to Remote Code Execution in versions up to and including 2.4.9. This is due to the prepare post data function mapping user-supplied keys directly into internal placeholder storage, combined with the use of call user func on these placeholder values. This allows unauthenticated attackers to execute code on the server. The vulnerability is triggered via the form process function. The issue involves user-controlled placeholders and the call user func function, which can lead to unauthorized code execution.

Recommendations Versions prior to 2.4.9 should be updated.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-3584

Affected Products

Kali Forms

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2026-3584 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6cecd06f-c064-49fd-b3fa-505a5a0c2e0b?source=cve · Note
• https://twitter.com/Swisswpsecure/status/2042516095144173896 · Twitter Post
• https://twitter.com/0dayPublishing/status/2035108935485554830 · Twitter Post
• https://twitter.com/OrizonCyber/status/2035121729249390861 · Twitter Post
• https://twitter.com/CVEnew/status/2035262149635801336 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2037163668371292404 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2042331747912991154 · Twitter Post
• https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.9/Inc/Frontend/class-form-processor.php#L697 · Note
• https://plugins.trac.wordpress.org/changeset/3487024/kali-forms · Note
• https://twitter.com/DFIR_Radar/status/2043978448276795631 · Twitter Post
• https://twitter.com/Nav_the_Sham/status/2035747222004871182 · Twitter Post
• https://reddit.com/r/wpsafety/comments/1sczjty/state_of_wordpress_security_34951_cves_tracked · Reddit Post
• https://i.redd.it/5e2xkvzlh0vg1.png · Reddit Post
• https://twitter.com/CveFindCom/status/2035125051150811542 · Twitter Post