CVE-2026-3584: Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'formprocess' function. This is due to the 'preparepostdata' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'calluserfunc' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3584?
CVE-2026-3584 is classified as a critical vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2026-3584?
To mitigate CVE-2026-3584, you should update the Kali Forms plugin to version 2.4.10 or later.
What applications are affected by CVE-2026-3584?
CVE-2026-3584 affects all versions of the Kali Forms plugin for WordPress up to and including version 2.4.9.
Can CVE-2026-3584 be exploited without authentication?
Yes, CVE-2026-3584 can be exploited without authentication, allowing attackers to execute arbitrary code remotely.
What function is primarily responsible for the vulnerability in CVE-2026-3584?
The vulnerability in CVE-2026-3584 is primarily due to the 'form_process' function in the Kali Forms plugin.