{
 "id": "WPSEC-2026-2791",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2791/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2791/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2791/index.md",
 "title": "Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.31 - Unauthenticated Payment Bypass via PayPal Order Replay Across Forms",
 "description": "The Kali Forms plugin for WordPress is vulnerable to Payment Bypass via PayPal order replay across forms in versions 2.4.24 up to, and including, 2.4.31. This is due to consumed PayPal order IDs being recorded per form rather than site-wide. This makes it possible for unauthenticated attackers to reuse one completed PayPal order to submit another PayPal-enabled form on the same site. The other form must expect the same amount, currency and payee, so one payment can be counted more than once.",
 "plugin": {
  "slug": "kali-forms",
  "name": "Kali Forms — Contact Form & Drag-and-Drop Builder",
  "full_name": "Kali Forms — Contact Form & Drag-and-Drop Builder",
  "wordpress_org": "https://wordpress.org/plugins/kali-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/kali-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/kali-forms"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-837"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.4.24",
    "from_inclusive": true,
    "to": "2.4.32",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.4.24 before 2.4.32"
  ]
 },
 "introduced_in": "2.4.24",
 "fixed_in": "2.4.32",
 "remediation": "Update to 2.4.32 or later.",
 "fix_released": "2026-11-09T09:57:20+00:00",
 "published": "2026-11-10T10:55:25+00:00",
 "updated": "2026-11-09T23:33:51.503935+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2791/",
  "https://plugins.svn.wordpress.org/kali-forms/tags/2.4.32/",
  "https://wordpress.org/plugins/kali-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/kali-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}