CVE-2026-16144: Kali Forms WordPress Plugin Remote Code Execution

Executive Summary

A Remote Code Execution (RCE) vulnerability has been disclosed in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin. Tracked as CVE-2026-16144 with a CVSS score of 8.1 (High), the flaw allows authenticated attackers with low-level privileges to execute arbitrary code on the server by overwriting a trusted callable via the _save_data function.

CVSS Score: 8.1 (High)

Vulnerability Overview

Technical Details

Root Cause

The vulnerability resides in the _save_data() function within the plugin. This function saves form configuration data but fails to adequately validate the thisPermalink field value before using it to overwrite a trusted callable (function reference or object method). By supplying a crafted value for thisPermalink, an attacker can redirect execution to an arbitrary PHP function or user-defined callable, achieving remote code execution.

Attack Flow

1. Attacker authenticates to WordPress with any low-privilege account (e.g. Subscriber)
2. Sends crafted request targeting the _save_data() function
3. Supplies malicious thisPermalink field value pointing to attacker-controlled callable
4. Plugin overwrites the trusted callable without validation
5. Attacker triggers the overwritten callable to execute arbitrary PHP code
6. Full server-side code execution achieved

Callable Overwrite Pattern

This class of vulnerability — sometimes called "callable confusion" or "function pointer overwrite" — occurs when:

• User-supplied data is used to determine which PHP function to call
• No allowlist or type-checking is performed on the supplied value
• PHP's flexible callable syntax allows strings, arrays, and closures as callables

In this case, the thisPermalink field — seemingly an innocuous URL or slug — is repurposed as a callable reference, with no server-side validation preventing dangerous values.

Affected Products

Remediation

Immediate Actions

1. Update the plugin to a version newer than 2.4.20 if a patch is available
2. Disable the plugin if no patch is currently available
3. Audit form configurations for unexpected changes to callable fields
4. Review server logs for unusual PHP function invocations originating from the plugin
5. Restrict plugin access to trusted administrator accounts only during the interim

Detection

Monitor for unexpected PHP execution paths originating from Kali Forms plugin files. Web Application Firewalls (WAF) should be configured to flag and block requests containing PHP callable syntax in the thisPermalink parameter.

Risk Context

Although this vulnerability requires an authenticated (low-privilege) account, many WordPress sites permit open registration or have numerous contributor/subscriber accounts. Combined with the severity of full server-side code execution, CVE-2026-16144 represents a serious risk for any site running Kali Forms where user registration is enabled or where attacker access to any account is possible.

RCE vulnerabilities in widely-used form builder plugins are particularly attractive targets because:

• Form plugins are installed on millions of WordPress sites
• They typically process user-supplied data by design
• Exploitation grants full server control, not just WordPress admin access

References

• NVD — CVE-2026-16144
• WordPress Plugin Directory — Kali Forms

Related Reading

• CVE-2026-15964: WordPress SSO Plugin Critical Authentication Bypass
• BeyondTrust Remote Support Critical RCE Under Active Exploitation