CVE-2026-3584 PoC — Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3584.yaml

Associated Vulnerability

Title:Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process (CVE-2026-3584)
Description:The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.

Description

Kali Forms WordPress plugin <= 2.4.9 contains a remote code execution caused by unsafe user input handling in 'form_process' and 'prepare_post_data' functions, letting unauthenticated attackers execute code on the server, exploit requires no authentication.

File Snapshot


 id: CVE-2026-3584

info:
  name: WordPress Kali Forms <= 2.4.9 - Remote Code Execution
  author: pus

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!