Junglewise Threat Intelligence

CVE-2026-16144: wpchill Kali Forms remote code execution in _save_data

CVE-2026-16144 · Severity: high · CVSS 8.1 · Published 2026-08-01

Executive brief

Kali Forms, a popular WordPress plugin used for building contact forms, contains a security flaw that could allow an attacker to take control of a website. By submitting specially crafted data through a form, an unauthenticated user could execute malicious code on the server. This could lead to a complete site takeover, theft of customer data, or service disruption. The risk is highest for forms that use specific internal field names like 'thisPermalink'.

Technical details

The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution (RCE) due to a code injection flaw in the `_save_data` function. The vulnerability stems from insufficient validation of the 'thisPermalink' field value, which allows an attacker-controlled string to overwrite a trusted callable placeholder. This string eventually reaches the PHP `call_user_func()` function. An unauthenticated attacker can exploit this by submitting a POST request to a form that contains a field name matching reserved keys such as 'thisPermalink', 'entryCounter', or 'submission_link'. Successful exploitation allows for arbitrary code execution on the underlying server. The issue is addressed in versions following 2.4.20.

Affected products

  • wpchill Kali Forms — Contact Form & Drag-and-Drop Builder up to, and including, 2.4.20

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory

References