Is CVE-2026-39782 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39782 being exploited in the wild.

How severe is CVE-2026-39782?

Medium severity, with a CVSS score of 5.3, published 29 October 2026.

Which products and versions are affected?

Kaliforms Kali Forms through 2.4.27.

Is there a fix for CVE-2026-39782?

Yes: fixed in 2.4.28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39782 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39782?

Check whether you run Kaliforms Kali Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39782: Kaliforms Kali Forms broken access control

CVE-2026-39782 · Severity: medium · CVSS 5.3 · Published 2026-10-29

Kali Forms is a WordPress plugin that allows users to create and manage forms on their websites. A broken access control vulnerability in the plugin allows unauthenticated attackers to view or perform actions they should not have permission to access, potentially exposing sensitive form data or allowing unauthorized form submissions. The vulnerability affects all versions up to and including 2.4.27.

Technologies: Kaliforms Kali Forms. Vendors: Kaliforms.

Quick answers

Is CVE-2026-39782 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39782 being exploited in the wild.
How severe is CVE-2026-39782?: Medium severity, with a CVSS score of 5.3, published 29 October 2026.
Which products and versions are affected?: Kaliforms Kali Forms through 2.4.27.
Is there a fix for CVE-2026-39782?: Yes: fixed in 2.4.28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39782 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39782?: Check whether you run Kaliforms Kali Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.4.28

Technical details

A broken access control vulnerability in Kali Forms fails to properly enforce authorization checks, allowing unauthenticated users to access restricted pages or perform privileged actions. The vulnerability can be exploited via network access without authentication, enabling attackers to view other users' data or perform unauthorized operations within the form builder or submitted data.

Affected products

Kaliforms Kali Forms through 2.4.27

Timeline

2026-10-29: disclosed
2026-10-29: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.