Description

Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-27T10:16:39.427Z",
  "pubdate": "2026-08-27T10:16:39.427Z",
  "executiveSummary": "The Kali Forms plugin for WordPress, in versions 2.4.23 and below, contains a critical broken access control vulnerability. This security flaw allows unauthenticated remote attackers to bypass authorization mechanisms, potentially leading to unauthorized access to sensitive application data or administrative functionality.\nThe vulnerability originates from a failure to perform adequate permission checks on sensitive API endpoints or data-handling functions. An attacker can exploit this via crafted HTTP requests without the need for a valid session or elevated privileges.\nThe primary risk implications involve the potential for data exfiltration, modification of form submissions, or administrative configuration changes depending on the specific functions exposed. Given that the vulnerability does not require authentication, the attack surface is significantly increased, as any unauthenticated user with network access to the target system can initiate the exploit.\nImmediate remediation involves updating the Kali Forms plugin to a patched version once available. In the absence of a direct update, organizations should consider temporary measures such as implementing WAF rules to filter malicious requests or restricting access to the affected endpoints until the vulnerability is addressed.",
  "technicalDetails": "The vulnerability resides within the Kali Forms plugin (versions 2.4.23 and below), specifically affecting the handling of requests that should be restricted to administrative users or authenticated entities. The root cause is a deficiency in the access control implementation, where the application fails to verify the authentication status or authorization level of a requester before executing sensitive backend logic or returning protected form data.\nFrom an architectural standpoint, the vulnerability typically manifests when the plugin exposes REST API endpoints or AJAX handlers that lack proper security nonces or session validation checks. Under normal operation, these components are intended to be accessed only by authorized WordPress users; however, the lack of rigorous server-side verification allows these checks to be bypassed entirely.\nThe exploitation flow is relatively straightforward: an attacker sends an unauthenticated HTTP request (GET, POST, or PUT, depending on the specific vulnerable endpoint) to the target URL. Because the application logic does not validate the sender's identity or authorization context, the request is processed as if it were a legitimate administrative or authorized call.\nTechnically, the vulnerability involves the improper usage of WordPress hook patterns, such as 'wp_ajax_' or 'wp_ajax_nopriv_' callbacks, where access control checks (e.g., current_user_can()) are either omitted or incorrectly applied to functions that should be private. If an attacker identifies an endpoint responsible for retrieving form submissions or managing plugin settings, they can perform automated queries to exfiltrate database contents or modify form workflows without any prior system access.\nPost-exploitation impact varies depending on the specific functionality exposed through the vulnerable endpoint. This can result in unauthorized disclosure of Personal Identifiable Information (PII) collected by forms, unauthorized modification of form data, or the potential for further exploitation if administrative settings can be manipulated. Since the vulnerability is unauthenticated, it does not leave standard authentication logs, making detection more difficult without deep inspection of web application firewall (WAF) or server access logs for anomalous, high-frequency requests to specific plugin-related endpoints."
}