Executive brief
A vulnerability in the Kali Forms plugin for WordPress allows unauthorized individuals to upload files to a website's media library without needing an account. While the plugin restricts these uploads to standard file types like images and documents, preventing direct server takeover, it could still be used to host unauthorized content or consume storage space. The uploaded files are automatically deleted by the system after approximately 15 minutes.
Technical details
The Kali Forms plugin fails to validate that a file upload request is associated with an existing form configured with a file-upload field. An unauthenticated attacker can first leak a valid AJAX nonce via the 'kaliforms_get_js_var' action and then use that nonce to trigger the 'kaliforms_form_upload_file' action. While this allows arbitrary file uploads to the WordPress Media Library, the impact is mitigated because the plugin relies on WordPress core's default MIME type checks, preventing the upload of executable scripts (like PHP). Additionally, the plugin schedules a WP-cron event to delete these transient uploads approximately 15 minutes after they are processed. The issue is fixed in version 2.4.17.
Affected products
- Kali Forms Kali Forms — Contact Form & Drag-and-Drop Builder < 2.4.17
Timeline
- 2026-06-24: disclosed: Initial public disclosure by researcher
- 2026-07-15: advisory: NVD publication date
- 2026-07-15: patched: Fix confirmed in version 2.4.17