CVE-2026-16144

Name of the Vulnerable Software and Affected Versions Kali Forms — Contact Form & Drag-and-Drop Builder versions prior to 2.4.21

Description Unauthenticated attackers can achieve remote code execution on the server through the save data() function. The issue stems from insufficient validation of the thisPermalink field value, which allows it to overwrite a trusted callable placeholder. Consequently, attacker-controlled strings can reach the call user func() function. For exploitation to be successful, the target form must define a field with a name matching one of the reserved placeholder keys: thisPermalink, entryCounter, or submission link, because the check if placeholders changed() function only processes POST keys present in the form's field type map.

Recommendations Update to a version newer than 2.4.20. As a temporary mitigation, avoid using the thisPermalink, entryCounter, or submission link parameters in form fields.