What the vulnerability does
01Description
The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.8. This is due to the `get_items_permissions_check()` permission callback on the `/kaliforms/v1/forms/{id}` REST API endpoint only checking for the `edit_posts` capability without verifying that the requesting user has ownership or authorization over the specific form resource. This makes it possible for authenticated attackers, with Contributor-level access and above, to read form configuration data belonging to other users (including administrators) by enumerating form IDs. Exposed data includes form field structures, Google reCAPTCHA secret keys (if configured), email notification templates, and server paths.
Explanation of Vulnerability in Simple Terms
02Summary
Kali Forms versions 2.4.8 and earlier lack proper authorization checks, allowing authenticated users with low privileges to access sensitive form data they should not be able to view. An attacker with a standard user account can read information from contact forms without restriction. This affects the confidentiality of form submissions but does not allow modification or deletion of data.
What an attacker can do
03Attacker Capabilities
Read contact form data and submissions they should not have access to.
Potential impact on your site
04Site Impact
Form submissions and user data collected via Kali Forms may be exposed to unauthorized site users.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the WordPress site.
Key dates
06Disclosure timeline
February 18, 2026
CVE published
April 8, 2026
Record updated
