CyberRota Analysis
AI-GeneratedThe Kali Forms plugin for WordPress is vulnerable to Remote Code Execution due to insufficient validation of the 'thisPermalink' field in the _save_data function, allowing unauthenticated attackers to execute arbitrary code on the server. This vulnerability affects all versions up to and including 2.4.20 and requires specific form field definitions to exploit. WordPress site administrators using this plugin should prioritize immediate updates to mitigate the risk of server compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.