Is CVE-2026-11580 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11580 being exploited in the wild.

How severe is CVE-2026-11580?

Informational severity, with a CVSS score of 5.5, published 15 July 2026.

Is there a fix for CVE-2026-11580?

A patch was published on 2026-07-15: Fixed in version 2.4.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11580 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11580?

Check whether you run Kali Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11580: Kali Forms WordPress plugin IDOR in post-duplication AJAX action

CVE-2026-11580 · Severity: info · CVSS 5.5 · Published 2026-07-15

Kali Forms, a popular WordPress plugin for building contact forms, contains a security flaw that allows low-privileged users (like Contributors) to access private information. By exploiting this, an attacker can duplicate any post or page on the site—even those they shouldn't see—and read sensitive metadata, such as private notes or secret API keys. This could lead to the exposure of confidential business data or credentials used by other site components.

Technologies: Kali Forms. Vendors: Kali Forms.

Quick answers

Is CVE-2026-11580 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11580 being exploited in the wild.
How severe is CVE-2026-11580?: Informational severity, with a CVSS score of 5.5, published 15 July 2026.
Which products and versions are affected?: Kali Forms < 2.4.17.
Is there a fix for CVE-2026-11580?: A patch was published on 2026-07-15: Fixed in version 2.4.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11580 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11580?: Check whether you run Kali Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) within the 'kaliforms_duplicate_post' AJAX action. The plugin does not perform a per-object capability check to verify if the requesting user has permission to access the source post being duplicated. An authenticated attacker with Contributor-level access or higher can provide an arbitrary post ID to the AJAX action, which then creates a published duplicate of that post under the attacker's ownership. This process copies all associated post metadata, allowing the attacker to read private custom fields and secrets (such as API keys) belonging to other users or plugins. The issue is fixed in version 2.4.17.

Affected products

Kali Forms Kali Forms — Contact Form & Drag-and-Drop Builder < 2.4.17

Timeline

2026-06-24: disclosed: Publicly published by WPScan
2026-07-15: advisory: NVD publication date
2026-07-15: patched: Fixed in version 2.4.17

References

https://wpscan.com/vulnerability/d73500e1-a8bc-4d31-ad9b-d1f71212bcc7/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.