Vulnerabilities / Kali Forms — Contact Form & Drag-and-Drop Builder / WPSEC-2026-2791
Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.31 - Unauthenticated Payment Bypass via PayPal Order Replay Across Forms
Low 3.7
CWE-837Fixed in 2.4.32
- ID
- WPSEC-2026-2791
- Plugin
- Kali Forms — Contact Form & Drag-and-Drop Builder (kali-forms)
- Affected
- from 2.4.24 before 2.4.32
- Remediation
- Update to 2.4.32 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-837
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Kali Forms — Contact Form & Drag-and-Drop Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Kali Forms plugin for WordPress is vulnerable to Payment Bypass via PayPal order replay across forms in versions 2.4.24 up to, and including, 2.4.31. This is due to consumed PayPal order IDs being recorded per form rather than site-wide. This makes it possible for unauthenticated attackers to reuse one completed PayPal order to submit another PayPal-enabled form on the same site. The other form must expect the same amount, currency and payee, so one payment can be counted more than once.
References
- https://wpsec.com/vuln/WPSEC-2026-2791/
- https://plugins.svn.wordpress.org/kali-forms/tags/2.4.32/
- https://wordpress.org/plugins/kali-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS