CVE-2026-39782: WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability
Published Oct 29, 2026
·Updated
Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kali-formsto a version that resolves this vulnerability.Fixed in 2.4.28
Event History
Oct 29, 2026
CVE Published
via MITRE·01:56 PM
Data Sourced
via MITRE·01:56 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
Kali Forms versions through 2.4.27 are affected. The available data does not identify a safe fixed version.
2
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What is the likely security impact?
The reported impact is limited to confidentiality. The CVSS vector indicates low confidentiality impact and no integrity or availability impact.