CVE-2026-1860: Kali Forms IDOR Vulnerability in WordPress

CVE-2026-1860 Overview

The Kali Forms plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 2.4.8. The flaw exists in the get_items_permissions_check() permission callback on the /kaliforms/v1/forms/{id} REST API endpoint, which only verifies the edit_posts capability without confirming that the requesting user has ownership or authorization over the specific form resource being accessed.

This vulnerability enables authenticated attackers with Contributor-level access or above to read form configuration data belonging to other users, including administrators, by enumerating form IDs. Exposed data includes form field structures, Google reCAPTCHA secret keys (if configured), email notification templates, and server paths.

Critical Impact

Authenticated attackers can access sensitive form configuration data including reCAPTCHA secret keys, email templates, and server paths belonging to other users by exploiting broken access control in the REST API.

Affected Products

• Kali Forms plugin for WordPress versions up to and including 2.4.8
• WordPress installations with vulnerable Kali Forms versions
• Sites with authenticated users having Contributor-level access or higher

Discovery Timeline

• 2026-02-18 - CVE-2026-1860 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1860

Vulnerability Analysis

This vulnerability is classified as CWE-862: Missing Authorization. The core issue stems from an incomplete authorization check in the Kali Forms REST API controller. When handling requests to the /kaliforms/v1/forms/{id} endpoint, the plugin's get_items_permissions_check() function validates that the requesting user possesses the edit_posts capability but fails to perform a crucial object-level authorization check.

In WordPress, the edit_posts capability is granted to users with Contributor role and above. While this capability check is appropriate for determining whether a user can create and edit their own posts, it is insufficient for protecting sensitive form resources that may belong to other users, including administrators.

The authorization gap allows any authenticated user meeting the minimum capability requirement to access arbitrary form configurations by simply iterating through form IDs in the REST API request. This represents a classic horizontal privilege escalation via Insecure Direct Object Reference.

Root Cause

The root cause is the absence of object-level authorization validation in the class-forms-rest-controller.php file. The permission callback relies solely on a capability-based check (edit_posts) rather than implementing proper resource ownership verification. The vulnerable code path can be traced through the REST controller implementation.

A secure implementation would verify that the requesting user either owns the form being requested or has explicit administrative privileges to access all forms. Without this check, the authorization boundary is effectively bypassed for any authenticated user with basic editing capabilities.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. An attacker would first authenticate to a WordPress site with at least Contributor-level access. Once authenticated, the attacker can craft REST API requests to the vulnerable endpoint, systematically enumerating form IDs to discover and access form configurations belonging to other users.

The exploitation flow involves:

1. Obtaining valid WordPress credentials for an account with edit_posts capability
2. Sending authenticated requests to /wp-json/kaliforms/v1/forms/{id} with incrementing form IDs
3. Parsing successful responses to extract sensitive configuration data including reCAPTCHA secrets, email notification settings, and server paths

Detection Methods for CVE-2026-1860

Indicators of Compromise

• Unusual volume of REST API requests to /wp-json/kaliforms/v1/forms/ endpoints from a single user account
• Sequential or systematic form ID enumeration patterns in access logs
• Contributor or Author-level accounts accessing form resources they did not create
• API requests returning form data containing reCAPTCHA secrets or sensitive configuration

Detection Strategies

• Monitor WordPress REST API access logs for requests to /kaliforms/v1/forms/{id} endpoints with varying form IDs from non-administrator users
• Implement alerting for failed authorization attempts or access to form resources outside a user's ownership scope
• Review audit logs for patterns of systematic resource enumeration by low-privileged accounts
• Deploy web application firewall rules to detect rapid sequential API requests to the vulnerable endpoint

Monitoring Recommendations

• Enable detailed logging for WordPress REST API endpoints, particularly those related to form plugins
• Establish baseline behavior for legitimate form access patterns and alert on deviations
• Monitor for unauthorized access to sensitive configuration data in form responses
• Implement rate limiting on REST API endpoints to slow enumeration attacks

How to Mitigate CVE-2026-1860

Immediate Actions Required

• Update Kali Forms plugin to a version newer than 2.4.8 that includes the authorization fix
• Review access logs for evidence of exploitation attempts targeting the vulnerable endpoint
• Rotate any Google reCAPTCHA secret keys that may have been exposed through vulnerable forms
• Audit Contributor-level and Author-level user accounts for suspicious activity

Patch Information

The vulnerability has been addressed in a subsequent version of the Kali Forms plugin. The security patch changeset implements proper object-level authorization checks to verify that requesting users have ownership or administrative access to the specific form resources they are attempting to access.

Organizations should update to the latest available version through the WordPress plugin repository. Additional technical details about this vulnerability are available in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the Kali Forms plugin until the patch can be applied if the forms are not business-critical
• Restrict REST API access using security plugins or .htaccess rules to limit requests to the vulnerable endpoint
• Remove unnecessary Contributor and Author accounts or temporarily demote them to Subscriber role
• Implement additional authentication layers such as IP whitelisting for administrative WordPress functions

# Restrict REST API access via .htaccess as a temporary mitigation
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/kaliforms/v1/forms/ [NC]
    RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.
    RewriteRule .* - [F,L]
</IfModule>