CVE-2026-11580

Name of the Vulnerable Software and Affected Versions Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin versions prior to 2.4.17

Description Insufficient per-object capability checks in the post-duplication AJAX action allow users with Contributor-level access or higher to duplicate any post, regardless of its owner, status, or post type. This action results in the creation of a published post owned by the attacker, which enables them to read private post metadata, including secrets stored by other users.

Recommendations Update Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin to version 2.4.17 or later.