CVE-2026-3584 identifies a critical Remote Code Execution (RCE) vulnerability impacting all versions of the Kali Forms plugin for WordPress up to and including 2.4.9. This flaw allows unauthenticated attackers to execute arbitrary code on the server due to improper handling of user-supplied data within the 'form_process' and 'prepare_post_data' functions. With a CVSS score of 9.8, this vulnerability represents a network-based attack with low complexity, requiring no privileges or user interaction, leading to a complete compromise of confidentiality, integrity, and availability. While there is no confirmed active exploitation (KEV: No) and public exploit code is not yet available on common platforms, the severe impact necessitates immediate patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Wpchill | Kali Forms — Contact Form & Drag-And-Drop Builder | >= 0, <= 2.4.9CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.