CVE-2026-16144

The CVE-2026-16144 entry concerns Kali Forms ≤ 2.4.20 (WordPress plugin) with unauthenticated Remote Code Execution via the _save_data function. The root cause is insufficient validation of the _save_data() path when a form field value can overwrite a trusted placeholder, allowing attacker-contro...

CVE-2026-16144

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...