CVE-2026-16144: Kali Forms WordPress Plugin RCE Vulnerability

CVE-2026-16144 Overview

CVE-2026-16144 is a Remote Code Execution (RCE) vulnerability in the Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress. The flaw affects all versions up to and including 2.4.20 and resides in the _save_data function of the form processor. Insufficient validation of the thisPermalink field allows attacker-controlled input to overwrite a trusted callable placeholder that is later executed via call_user_func(). Unauthenticated attackers can leverage this behavior to execute arbitrary PHP code on the server. The weakness is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Unauthenticated remote code execution on WordPress sites running Kali Forms, leading to full site compromise.

Affected Products

Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress
All versions up to and including 2.4.20
WordPress installations with a Kali Forms form defining a field named thisPermalink, entryCounter, or submission_link

Discovery Timeline

2026-08-01 - CVE-2026-16144 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16144

Vulnerability Analysis

The Kali Forms plugin processes submitted form data through the _save_data function inside class-form-processor.php. During processing, the plugin substitutes reserved placeholder keys such as thisPermalink, entryCounter, and submission_link with trusted callables that later flow into call_user_func(). The helper method check_if_placeholders_changed() iterates over POST keys that are also present in the form's field_type_map, and it does not validate whether the incoming value is a safe placeholder or an attacker-supplied string. As a result, the trusted callable slot can be overwritten by untrusted input from the HTTP request. When _save_data subsequently invokes the callable, PHP executes attacker-controlled code within the WordPress process. See the Wordfence Vulnerability Intelligence entry for further context.

Root Cause

The root cause is improper control of code generation [CWE-94]. The plugin trusts POST values to represent placeholder replacements without confirming the value type or origin. Because the overwritten variable is later passed to call_user_func(), any string an attacker supplies is treated as a callable name and invoked.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. The attacker must locate a public Kali Forms form whose field_type_map defines a field name matching one of the reserved keys (thisPermalink, entryCounter, or submission_link). The attacker submits a crafted POST request to the form endpoint with the reserved key set to a PHP function name. When _save_data reaches the affected call site, call_user_func() executes the attacker-supplied function on the server. This dependency on a matching field name is reflected in the high attack complexity rating.

No public proof-of-concept exploit is currently listed. Refer to the Kali Forms class-form-processor.php source at line 976 and line 1033 for the vulnerable code paths.

Detection Methods for CVE-2026-16144

Indicators of Compromise

POST requests to Kali Forms submission endpoints containing parameters named thisPermalink, entryCounter, or submission_link with values resembling PHP function names such as system, shell_exec, passthru, or assert.
Unexpected outbound network connections from the PHP-FPM or web server process shortly after Kali Forms submissions.
Creation of new PHP files, cron entries, or WordPress admin users following form submissions.
Web server error logs referencing call_user_func() with unusual callable arguments in class-form-processor.php.

Detection Strategies

Inspect web access logs for POST requests to Kali Forms handlers where reserved placeholder keys carry non-URL, non-numeric string values.
Enable PHP disable_functions audit logging and alert on invocations of high-risk functions originating from the plugin's directory.
Compare installed Kali Forms plugin versions across the estate against the fixed release, and flag any host running 2.4.20 or earlier.

Monitoring Recommendations

Forward WordPress, PHP, and web server logs into a centralized analytics platform for correlation with process telemetry.
Monitor endpoint telemetry on WordPress hosts for the PHP interpreter spawning shells, package managers, or network utilities.
Track file integrity for the WordPress wp-content, plugin, and upload directories and alert on unexpected writes.

How to Mitigate CVE-2026-16144

Immediate Actions Required

Update the Kali Forms plugin to the version that supersedes 2.4.20 as published by the vendor via the WordPress plugin changeset.
Audit every Kali Forms form for fields named thisPermalink, entryCounter, or submission_link and rename or remove them.
Review WordPress user accounts, scheduled tasks, and plugin/theme files for signs of post-exploitation activity.

Patch Information

The vendor released a fix in the Kali Forms plugin update that follows version 2.4.20. Administrators should apply the update through the WordPress plugin manager or by deploying the patched release from the plugin repository. Refer to the Kali Forms plugin changeset for the code changes to class-form-processor.php.

Workarounds

Temporarily disable the Kali Forms plugin on affected WordPress sites until the update is applied.
Restrict access to /wp-admin/admin-ajax.php and form submission endpoints using a Web Application Firewall (WAF) rule that blocks POST parameters named thisPermalink, entryCounter, or submission_link when their values contain PHP function names.
Remove or rename any custom form fields that collide with the reserved placeholder keys.

bash

# Example WAF rule (ModSecurity) to block reserved placeholder abuse
SecRule ARGS_NAMES "@rx ^(thisPermalink|entryCounter|submission_link)$" \
    "id:1026144,phase:2,deny,status:403,log,\
     msg:'CVE-2026-16144 Kali Forms placeholder abuse',\
     chain"
    SecRule ARGS "@rx ^(system|exec|shell_exec|passthru|assert|eval|proc_open|popen)$" \
        "t:none,t:lowercase"