CVE-2026-3584

Published: Mar 20, 2026 Last Modified: Mar 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.

94

Improper Control of Generation of Code ('Code Injection')

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Integrity Confidentiality Availability Non-Repudiation
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands Hide Activities
Applicable Platforms
Languages: Interpreted
Technologies: AI/ML
Likelihood of Exploit: Medium
View CWE Details
https://plugins.trac.wordpress.org/browser/kali-forms/tags/…
https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.9/Inc/Frontend/c…
https://plugins.trac.wordpress.org/changeset/3487024/kali-f…
https://plugins.trac.wordpress.org/changeset/3487024/kali-forms
https://www.wordfence.com/threat-intel/vulnerabilities/id/6…
https://www.wordfence.com/threat-intel/vulnerabilities/id/6cecd06f-c064-49fd-b3…