CVE-2026-3584: Kali Forms WordPress Plugin RCE Vulnerability

CVE-2026-3584 Overview

The Kali Forms plugin for WordPress contains a critical Remote Code Execution (RCE) vulnerability affecting all versions up to and including 2.4.9. The vulnerability exists in the form_process function where the prepare_post_data function maps user-supplied keys directly into internal placeholder storage. Combined with the use of call_user_func on these placeholder values, unauthenticated attackers can execute arbitrary code on the server.

Critical Impact

Unauthenticated attackers can achieve complete server compromise by executing arbitrary code through malicious form submissions, potentially leading to full site takeover, data theft, and lateral movement within the hosting environment.

Affected Products

• Kali Forms plugin for WordPress versions up to and including 2.4.9

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-3584 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3584

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The flaw stems from a dangerous combination of two insecure coding practices within the Kali Forms plugin's form processing logic.

The prepare_post_data function accepts user-controlled input and directly maps the supplied keys into the plugin's internal placeholder storage mechanism. This design flaw allows an attacker to inject arbitrary placeholder names and values into the application's data structures. The critical escalation occurs because the plugin subsequently uses PHP's call_user_func on these placeholder values, enabling attackers to invoke arbitrary PHP functions with controlled arguments.

Since the vulnerability requires no authentication, any visitor to a WordPress site running a vulnerable version of Kali Forms can exploit this flaw simply by submitting a specially crafted form request.

Root Cause

The root cause is improper input validation combined with unsafe use of dynamic function invocation. The prepare_post_data function trusts user-supplied keys without sanitization, allowing attackers to pollute internal data structures. The subsequent use of call_user_func on these attacker-controlled values creates a direct path to arbitrary code execution. This violates the principle of never executing user-controlled data as code.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft a malicious HTTP POST request to a WordPress site's form endpoint, injecting specially formatted keys that map to dangerous PHP functions. When the form processor evaluates the placeholders using call_user_func, the attacker's chosen function is executed with attacker-controlled arguments.

The attack flow involves:

1. Identifying a WordPress site using a vulnerable version of Kali Forms
2. Crafting a POST request with malicious key-value pairs targeting the form_process endpoint
3. The prepare_post_data function stores these malicious values as placeholders
4. When placeholder resolution occurs via call_user_func, arbitrary PHP code executes

Technical details can be found in the WordPress Kali Forms Code Review.

Detection Methods for CVE-2026-3584

Indicators of Compromise

• Unexpected POST requests to WordPress form endpoints containing unusual parameter names resembling PHP function calls
• Web server logs showing form submissions with parameters like system, exec, passthru, or other dangerous PHP functions as keys
• New files created in WordPress directories, particularly PHP files in upload or temporary folders
• Unusual outbound network connections from the web server process

Detection Strategies

• Monitor web application firewall (WAF) logs for POST requests to Kali Forms endpoints containing suspicious parameter patterns
• Implement file integrity monitoring to detect new or modified PHP files in WordPress installations
• Review web server access logs for anomalous form submission patterns, particularly requests with function-like parameter names
• Deploy runtime application self-protection (RASP) solutions to detect call_user_func invocations with suspicious arguments

Monitoring Recommendations

• Enable detailed logging on WordPress sites using Kali Forms and review for unusual form processing activity
• Configure security plugins to alert on code execution attempts and suspicious PHP function invocations
• Implement network monitoring to detect command-and-control traffic originating from compromised WordPress servers
• Set up automated vulnerability scanning to identify WordPress plugins requiring security updates

How to Mitigate CVE-2026-3584

Immediate Actions Required

• Update Kali Forms plugin to the latest patched version immediately
• If unable to update immediately, temporarily disable the Kali Forms plugin until patching is possible
• Review server logs for indicators of prior exploitation attempts
• Conduct a security audit of the WordPress installation for signs of compromise

Patch Information

The vulnerability has been addressed in versions after 2.4.9. The fix can be reviewed in the WordPress Kali Forms Changeset. Site administrators should update to the latest available version through the WordPress plugin update mechanism. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Disable the Kali Forms plugin entirely until the patch can be applied
• Implement a Web Application Firewall (WAF) rule to block POST requests containing suspicious parameter names targeting form endpoints
• Restrict access to form submission endpoints using IP-based access controls where feasible
• Enable WordPress hardening measures including disabling file editing and restricting PHP execution in upload directories

# WordPress wp-config.php hardening example
# Add to wp-config.php to disable file editing
define('DISALLOW_FILE_EDIT', true);

# .htaccess rule to block PHP execution in uploads
# Add to wp-content/uploads/.htaccess
<FilesMatch "\.php$">
    Deny from all
</FilesMatch>