CVE-2026-11579: Kali Forms WordPress Auth Bypass Flaw

CVE-2026-11579 Overview

CVE-2026-11579 affects the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin in versions before 2.4.17. The plugin fails to verify that a file upload request corresponds to an existing form configured with a file-upload field. As a result, unauthenticated attackers can upload files directly to the WordPress Media Library without any valid form context. The uploads are constrained to WordPress's default-allowed MIME types, which prevents direct code execution. The issue is classified as [CWE-434] Unrestricted Upload of File with Dangerous Type, though the MIME restriction limits the practical impact to unauthorized storage use and content injection.

Critical Impact
Unauthenticated remote attackers can populate the WordPress Media Library with arbitrary files of allowed MIME types, enabling storage abuse and potential content-based attacks.

Affected Products

Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin versions prior to 2.4.17
WordPress sites with the vulnerable plugin installed and activated
Any deployment exposing the plugin's file-upload endpoint to the network

Discovery Timeline

2026-07-15 - CVE-2026-11579 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-11579

Vulnerability Analysis

The vulnerability stems from missing validation in the plugin's file-upload handler. When a client submits a file upload, the plugin does not confirm that the request references an actual form containing a file-upload field. The handler accepts and processes the upload regardless of form context. Files that pass WordPress's default MIME type checks are written into the Media Library and become accessible via standard WordPress media URLs.

Because authentication is not required and no form must exist, any internet-facing WordPress instance running an affected version is exposed. The [CWE-434] classification reflects the missing upload authorization check. The scope is limited by WordPress core MIME filtering, so attackers cannot upload PHP or other executable content through this path.

Root Cause

The root cause is a missing authorization and context check in the file upload endpoint. The plugin trusts inbound upload requests without cross-referencing them against a valid, published form configured to accept files. This design flaw permits uploads to occur in isolation from the form workflow the plugin was intended to serve.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP request to the plugin's upload endpoint with a file payload matching an allowed MIME type. The plugin stores the file in the Media Library and returns a reference. Attackers can automate this to abuse storage, host images or documents on the victim's domain, or stage material for phishing and reputation attacks. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-11579

Indicators of Compromise

Unexpected files appearing in the WordPress wp-content/uploads/ directory without corresponding form submissions in plugin logs.
HTTP POST requests to Kali Forms upload endpoints originating from unauthenticated sessions or unfamiliar IP addresses.
Media Library entries with no associated author, post, or form reference.
Sudden growth in Media Library storage consumption on sites running Kali Forms below 2.4.17.

Detection Strategies

Correlate web server access logs against plugin form submission records to identify uploads without matching form activity.
Monitor wp-content/uploads/ for new files created outside expected editorial workflows.
Alert on repeated POST requests to Kali Forms AJAX or REST endpoints from single source addresses.

Monitoring Recommendations

Enable WordPress activity logging that captures Media Library additions with timestamp, source IP, and user context.
Track the installed version of the Kali Forms plugin across your WordPress fleet and flag any instance below 2.4.17.
Review Media Library contents on a scheduled basis for unauthorized files.

How to Mitigate CVE-2026-11579

Immediate Actions Required

Update the Kali Forms plugin to version 2.4.17 or later on all WordPress installations.
Audit the WordPress Media Library for unauthorized uploads created since the plugin was installed.
Restrict access to WordPress admin and plugin AJAX endpoints behind a web application firewall where feasible.

Patch Information

The vendor addressed the issue in Kali Forms version 2.4.17 by adding validation that ties file uploads to a valid form containing a file-upload field. Administrators should upgrade through the WordPress plugin management interface or via WP-CLI. Confirm the installed version after the upgrade completes. Details are available in the WPScan Vulnerability Report.

Workarounds

Deactivate the Kali Forms plugin until the patch can be applied if immediate upgrade is not possible.
Block unauthenticated POST requests to the plugin's upload endpoints at the WAF or reverse proxy layer.
Tighten WordPress MIME type allowlists to further limit acceptable upload types.

bash

# Configuration example
wp plugin update kali-forms --version=2.4.17
wp plugin list --name=kali-forms --field=version