Is CVE-2026-16144 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16144 being exploited in the wild.

How severe is CVE-2026-16144?

High severity, with a CVSS score of 8.1, published 1 August 2026.

Which products and versions are affected?

wpchill Kali Forms — Contact Form & Drag-and-Drop Builder up to, and including, 2.4.20.

Is there a fix for CVE-2026-16144?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16144 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16144?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16144: wpchill Kali Forms remote code execution in _save_data

CVE-2026-16144 · Severity: high · CVSS 8.1 · Published 2026-08-01

Kali Forms, a popular WordPress plugin used for building contact forms, contains a security flaw that could allow an attacker to take control of a website. By submitting specially crafted data through a form, an unauthenticated user could execute malicious code on the server. This could lead to a complete site takeover, theft of customer data, or service disruption. The risk is highest for forms that use specific internal field names like 'thisPermalink'.

Quick answers

Is CVE-2026-16144 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16144 being exploited in the wild.
How severe is CVE-2026-16144?: High severity, with a CVSS score of 8.1, published 1 August 2026.
Which products and versions are affected?: wpchill Kali Forms — Contact Form & Drag-and-Drop Builder up to, and including, 2.4.20.
Is there a fix for CVE-2026-16144?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16144 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16144?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution (RCE) due to a code injection flaw in the `_save_data` function. The vulnerability stems from insufficient validation of the 'thisPermalink' field value, which allows an attacker-controlled string to overwrite a trusted callable placeholder. This string eventually reaches the PHP `call_user_func()` function. An unauthenticated attacker can exploit this by submitting a POST request to a form that contains a field name matching reserved keys such as 'thisPermalink', 'entryCounter', or 'submission_link'. Successful exploitation allows for arbitrary code execution on the underlying server. The issue is addressed in versions following 2.4.20.

Affected products

wpchill Kali Forms — Contact Form & Drag-and-Drop Builder up to, and including, 2.4.20

Timeline

2026-08-01: disclosed
2026-08-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.