CVE-2026-11580: Kali Forms WordPress Auth Bypass Flaw

CVE-2026-11580 Overview

CVE-2026-11580 affects the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin in versions before 2.4.17. The plugin fails to perform a per-object capability check in its post-duplication AJAX action. Authenticated users with Contributor-level access or above can duplicate any post regardless of owner, post type, or status. The duplicated content becomes a published post owned by the attacker, exposing private post metadata including secrets stored by the plugin. The issue is classified as an Insecure Direct Object Reference [CWE-639].

Critical Impact
Contributor-level users can read private post metadata and secrets stored by the Kali Forms plugin by duplicating arbitrary posts they do not own.

Affected Products

Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin versions before 2.4.17
WordPress installations running the vulnerable Kali Forms plugin with Contributor or higher user accounts
Sites storing sensitive form configuration secrets in post metadata via Kali Forms

Discovery Timeline

2026-07-15 - CVE-2026-11580 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-11580

Vulnerability Analysis

The vulnerability resides in the post-duplication AJAX action exposed by the Kali Forms plugin. The handler accepts a target post identifier from the request but does not verify that the invoking user is authorized to access that specific object. Any authenticated user with the Contributor role or above can supply an arbitrary post ID. The plugin then clones the referenced post — including its post metadata — into a new published post owned by the requester. Because the resulting duplicate is owned by the attacker, they can read metadata fields that would otherwise be restricted to the original owner or to administrators.

Root Cause

The root cause is a missing per-object capability check in the AJAX handler. The plugin verifies that the caller has generic permission to use the duplication feature but never calls a capability check such as current_user_can( 'edit_post', $post_id ) against the requested target. This omission is characteristic of Insecure Direct Object Reference [CWE-639], where authorization is enforced at the function level but not against the specific object being manipulated.

Attack Vector

An attacker requires an authenticated account at Contributor level or above on the target WordPress site. The attacker sends an AJAX request to the plugin's duplication endpoint, specifying the ID of any post, page, or custom post type — including drafts, private posts, and posts owned by administrators. The server processes the request and creates a copy in the attacker's account with post status set to published. The attacker then reads the duplicated post and its metadata, exposing secrets such as API keys, integration credentials, or private form configuration data stored by Kali Forms.

No verified proof-of-concept code is available. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-11580

Indicators of Compromise

Unexpected published posts owned by Contributor-level accounts, particularly duplicates of drafts or private content
Entries in the WordPress database wp_posts table where post_author does not match the original author of the duplicated content
POST requests to admin-ajax.php referencing the Kali Forms duplication action from low-privileged user sessions

Detection Strategies

Review web server access logs for repeated admin-ajax.php calls invoking Kali Forms duplication actions from non-administrator user IDs
Audit the wp_posts table for recently created posts owned by Contributor accounts that mirror content from higher-privileged users
Correlate WordPress user activity logs with post creation events to identify anomalous duplication patterns

Monitoring Recommendations

Enable WordPress audit logging plugins to capture AJAX action invocations with associated user context
Alert on any Contributor-level account creating multiple published posts in a short time window
Monitor plugin update status across managed WordPress sites to identify installations still running Kali Forms below version 2.4.17

How to Mitigate CVE-2026-11580

Immediate Actions Required

Update the Kali Forms — Contact Form & Drag-and-Drop Builder plugin to version 2.4.17 or later on all WordPress installations
Audit all Contributor, Author, and Editor accounts and remove or disable any that are not actively required
Review post metadata for exposed secrets and rotate any credentials or API keys previously stored via Kali Forms

Patch Information

Upgrade the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin to version 2.4.17 or later. The fixed release adds the missing per-object capability check to the post-duplication AJAX handler. See the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the Kali Forms plugin until the update to version 2.4.17 or later can be applied
Restrict low-privileged user account creation and require administrator approval for new Contributor registrations
Apply a Web Application Firewall (WAF) rule to block AJAX requests targeting the Kali Forms duplication action from non-administrator sessions

bash

# Verify installed Kali Forms plugin version using WP-CLI
wp plugin get kali-forms --field=version

# Update the plugin to the patched release
wp plugin update kali-forms --version=2.4.17