# CVE-2026-11579: Kali Forms WordPress plugin unauthenticated file upload in Media Library

Source: https://junglewise.ai/threats/cve-2026-11579-kali-forms-wordpress-plugin-unauthenticated-file-upload-in-media  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-11579 · Severity: info · CVSS 5.3 · Published 2026-07-15

A vulnerability in the Kali Forms plugin for WordPress allows unauthorized individuals to upload files to a website's media library without needing an account. While the plugin restricts these uploads to standard file types like images and documents, preventing direct server takeover, it could still be used to host unauthorized content or consume storage space. The uploaded files are automatically deleted by the system after approximately 15 minutes.

Technologies: [Kali Forms](https://junglewise.ai/threats/technologies/kali-forms). Vendors: [Kali Forms](https://junglewise.ai/threats/vendors/kali-forms).

## Quick answers

**Is CVE-2026-11579 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11579 being exploited in the wild.

**How severe is CVE-2026-11579?** Informational severity, with a CVSS score of 5.3, published 15 July 2026.

**Which products and versions are affected?** Kali Forms < 2.4.17.

**Is there a fix for CVE-2026-11579?** A patch was published on 2026-07-15: Fix confirmed in version 2.4.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11579 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11579?** Check whether you run Kali Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Kali Forms plugin fails to validate that a file upload request is associated with an existing form configured with a file-upload field. An unauthenticated attacker can first leak a valid AJAX nonce via the 'kaliforms_get_js_var' action and then use that nonce to trigger the 'kaliforms_form_upload_file' action. While this allows arbitrary file uploads to the WordPress Media Library, the impact is mitigated because the plugin relies on WordPress core's default MIME type checks, preventing the upload of executable scripts (like PHP). Additionally, the plugin schedules a WP-cron event to delete these transient uploads approximately 15 minutes after they are processed. The issue is fixed in version 2.4.17.

## Affected products

- Kali Forms Kali Forms — Contact Form & Drag-and-Drop Builder < 2.4.17

## Timeline

- 2026-06-24: disclosed: Initial public disclosure by researcher
- 2026-07-15: advisory: NVD publication date
- 2026-07-15: patched: Fix confirmed in version 2.4.17

## References

- [https://wpscan.com/vulnerability/fae38fd0-8183-4864-8dae-0cd33a220bec/](https://wpscan.com/vulnerability/fae38fd0-8183-4864-8dae-0cd33a220bec/)

## Related threats

- [Kali Forms Contact Form stored XSS in button configuration](https://junglewise.ai/threats/cve-2026-106649-the-kali-forms-contact-form-drag-and-drop-builder-wordpress)
- [Kali Forms Contact Form Builder user email disclosure](https://junglewise.ai/threats/cve-2026-107342-the-kali-forms-contact-form-drag-and-drop-builder-wordpress)
- [Kali Forms broken access control](https://junglewise.ai/threats/cve-2026-81276-kali-forms-broken-access-control)
- [Kali Forms WordPress plugin IDOR in post-duplication AJAX action](https://junglewise.ai/threats/cve-2026-11580-kali-forms-wordpress-plugin-idor-in-post-duplication-ajax-action)
- [Kali Forms WordPress plugin Stored XSS in form field captions](https://junglewise.ai/threats/cve-2026-11581-kali-forms-wordpress-plugin-stored-xss-in-form-field-captions)