Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.27 - Unauthenticated Insecure Direct Object Reference to Media Library File Disclosure via File Upload Field
- ID
- WPSEC-2026-1923
- Plugin
- Kali Forms — Contact Form & Drag-and-Drop Builder (kali-forms)
- Affected
- all versions before 2.4.28
- Remediation
- Update to 2.4.28 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Kali Forms — Contact Form & Drag-and-Drop Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference via file upload fields in all versions up to, and including, 2.4.27, due to insufficient validation of the attachment IDs submitted in those fields. Upload tokens were only checked for fields the submitter listed in the 'extraArgs' parameter and were not bound to the form or field, so attachment IDs left in the submission reached the notification emailer, which attached the matching files. This makes it possible for unauthenticated attackers to attach arbitrary media library files, including files other visitors uploaded through forms, to a form's notification emails, disclosing them when a notification that attaches the upload field is sent to an address the attacker controls.
References
- https://wpsec.com/vuln/WPSEC-2026-1923/
- https://plugins.svn.wordpress.org/kali-forms/tags/2.4.28/
- https://wordpress.org/plugins/kali-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS