This vulnerability (CVE-2024-22305) in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). It affects all versions up to 2.3.36 and allows an attacker to bypass authorization mechanisms by manipulating a user-controlled key. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is confidentiality loss without integrity or availability impact. No patch or remediation details are currently available.

The vulnerability allows an unauthenticated attacker to bypass authorization controls, leading to unauthorized access to sensitive information within the affected plugin. The confidentiality of data can be compromised, but integrity and availability are not impacted. This could expose sensitive form data or administrative functions depending on the context of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the vulnerable plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.