# Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.27 - Unauthenticated Insecure Direct Object Reference to Media Library File Disclosure via File Upload Field

- **ID:** WPSEC-2026-1923
- **Plugin:** Kali Forms — Contact Form & Drag-and-Drop Builder (`kali-forms`), https://wordpress.org/plugins/kali-forms/
- **Affected versions:** all versions before 2.4.28
- **Fixed in:** 2.4.28 (Update to 2.4.28 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/kali-forms
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1923/

## Description

The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference via file upload fields in all versions up to, and including, 2.4.27, due to insufficient validation of the attachment IDs submitted in those fields. Upload tokens were only checked for fields the submitter listed in the 'extraArgs' parameter and were not bound to the form or field, so attachment IDs left in the submission reached the notification emailer, which attached the matching files. This makes it possible for unauthenticated attackers to attach arbitrary media library files, including files other visitors uploaded through forms, to a form's notification emails, disclosing them when a notification that attaches the upload field is sent to an address the attacker controls.

## References

- https://wpsec.com/vuln/WPSEC-2026-1923/
- https://plugins.svn.wordpress.org/kali-forms/tags/2.4.28/
- https://wordpress.org/plugins/kali-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1923/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.