CVE-2026-11579

Name of the Vulnerable Software and Affected Versions Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin versions prior to 2.4.17

Description Unauthenticated users can upload files to the WordPress Media Library because the plugin fails to verify if a file upload is associated with an existing form configured with a file-upload field. The system accepts uploads regardless of whether a valid form exists. These uploads are restricted to the default-allowed MIME types (Multipurpose Internet Mail Extensions, which are labels used to identify the nature and format of a document), preventing remote code execution.

Recommendations Update Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin to version 2.4.17 or later.