CVE-2026-16144: CWE-94 Improper Control of Generation of Code ('Code Injection') in wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.
AI Analysis
Technical Summary
CVE-2026-16144 is a remote code execution vulnerability in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin. The issue is due to improper control of code generation (CWE-94) where the '_save_data' function does not sufficiently validate the 'thisPermalink' field value before it overwrites a trusted callable placeholder. This allows attacker-controlled strings to be passed to call_user_func(), enabling code execution. Exploitation requires the target form to include a field named as one of the reserved placeholders ('thisPermalink', 'entryCounter', or 'submission_link'), as the function check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.
Potential Impact
An unauthenticated attacker can execute arbitrary code on the server hosting the vulnerable Kali Forms plugin, potentially leading to full compromise of the affected WordPress site. The vulnerability affects confidentiality, integrity, and availability (C, I, A) with high severity (CVSS 8.1).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, avoid using forms that define fields with reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link') or disable the plugin if possible.
CVE-2026-16144: CWE-94 Improper Control of Generation of Code ('Code Injection') in wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
Description
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.
CVSS v3.1
Score 8.1high
Affected software
wpchill
Kali Forms — Contact Form & Drag-and-Drop Builder
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16144 is a remote code execution vulnerability in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin. The issue is due to improper control of code generation (CWE-94) where the '_save_data' function does not sufficiently validate the 'thisPermalink' field value before it overwrites a trusted callable placeholder. This allows attacker-controlled strings to be passed to call_user_func(), enabling code execution. Exploitation requires the target form to include a field named as one of the reserved placeholders ('thisPermalink', 'entryCounter', or 'submission_link'), as the function check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.
Potential Impact
An unauthenticated attacker can execute arbitrary code on the server hosting the vulnerable Kali Forms plugin, potentially leading to full compromise of the affected WordPress site. The vulnerability affects confidentiality, integrity, and availability (C, I, A) with high severity (CVSS 8.1).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, avoid using forms that define fields with reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link') or disable the plugin if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-17T17:45:06.586Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6daf5bbf32cb7a346ced9e
Added to database: 08/01/2026, 08:33:31 UTC
Last enriched: 08/08/2026, 14:18:00 UTC
Last updated: 09/14/2026, 10:01:29 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.