Contact Form - Form builder by Kali Forms < 2.1.2 - Unauthenticated Arbitrary Post Deletion

The plugin registers the kaliformsformdeleteuploadedfile AJAX action to call the "deletefile" function, and makes it accessible to all users, authenticated or not...

Contact Form - Form builder by Kali Forms < 2.1.2 - Authenticated Plugin's Settings Change

The kaliformsupdateoptionajax AJAX action lacks capability and proper CSRF checks, allowing low privilege authenticated users to change or delete the plugin's settings...