WordPress Kali Forms Plugin Unauthenticated Remote Code Execution

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Kali Forms plugin for WordPress contains a critical remote code execution vulnerability in its _save_data function that allows unauthenticated attackers to execute arbitrary code on affected servers. The vulnerability stems from insufficient validation of the 'thisPermalink' field, which is used to overwrite a trusted callable placeholder before being passed to call_user_func(). This creates a direct pathway for attackers to inject malicious code without authentication, making any WordPress site running Kali Forms versions up to 2.4.20 vulnerable to complete server compromise. With a CVSS score of 8.1, this affects thousands of WordPress installations that rely on this popular form-building plugin.

Casky's 322 mapped skills detect this attack through Claude AI's analysis of two critical MITRE ATT&ACK techniques: TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would observe findings highlighting unsafe deserialization patterns and input validation gaps in the _save_data function, combined with detection of suspicious call_user_func() invocations with user-controlled parameters. The platform's extended reasoning capabilities would surface the attack chain: reconnaissance of vulnerable plugin versions, crafting malicious 'thisPermalink' payloads, and code execution without authentication. Security teams would see behavioral indicators including unexpected PHP execution contexts, suspicious form submission patterns with encoded payloads, and server-side function calls originating from untrusted sources—enabling them to identify exploitation attempts and remediate before compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16144.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-16144

Casky has 322 skills that investigate the attack patterns behind CVE-2026-16144. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn