Contact Form - Form builder by Kali Forms < 2.1.2 - Unauthenticated Arbitrary Post Deletion

The plugin registers the kaliformsformdeleteuploadedfile AJAX action to call the "deletefile" function, and makes it accessible to all users, authenticated or not...

Contact Form - Form builder by Kali Forms < 2.1.2 - Multiple CSRF Bypass Issues

Throughout the plugin’s code, security nonces can be bypassed because they are only checked if they are set...

VulnCheck KEV: CVE-2020-36720

The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the updateoption lacking proper authentication checks. This makes it possible for any authenticated attacker to change or delete the plugin's settings...