# Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.31 - Unauthenticated Payment Bypass via PayPal Order Replay Across Forms

- **ID:** WPSEC-2026-2791
- **Plugin:** Kali Forms — Contact Form & Drag-and-Drop Builder (`kali-forms`), https://wordpress.org/plugins/kali-forms/
- **Affected versions:** from 2.4.24 before 2.4.32
- **Fixed in:** 2.4.32 (Update to 2.4.32 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-837
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/kali-forms
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2791/

## Description

The Kali Forms plugin for WordPress is vulnerable to Payment Bypass via PayPal order replay across forms in versions 2.4.24 up to, and including, 2.4.31. This is due to consumed PayPal order IDs being recorded per form rather than site-wide. This makes it possible for unauthenticated attackers to reuse one completed PayPal order to submit another PayPal-enabled form on the same site. The other form must expect the same amount, currency and payee, so one payment can be counted more than once.

## References

- https://wpsec.com/vuln/WPSEC-2026-2791/
- https://plugins.svn.wordpress.org/kali-forms/tags/2.4.32/
- https://wordpress.org/plugins/kali-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2791/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.