CVE-2026-16144 is a remote code execution vulnerability in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin. It occurs due to improper validation of the 'thisPermalink' field in the _save_data function, which allows attacker-controlled strings to overwrite trusted callable placeholders. This leads to untrusted input being passed to call_user_func(), enabling unauthenticated attackers to execute arbitrary code on the server. Exploitation requires the target form to include a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as the function check_if_placeholders_changed() only processes POST keys present in the form's field_type_map. The vulnerability affects all versions up to and including 2.4.20. No patch or official fix has been announced as of the published date.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server hosting the vulnerable WordPress plugin. This can lead to full compromise of the web server, including data theft, service disruption, or further network penetration. The CVSS v3.1 base score is 8.1, indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable plugin or disable it if possible. Monitor for updates from the vendor wpchill regarding patches or mitigations. Avoid creating forms with fields named as reserved placeholder keys ('thisPermalink', 'entryCounter', 'submission_link') as a temporary mitigation measure.