Auth bypass in Wpchill Kali Forms — Contact Form & Drag-and-drop Builder
CVE-2026-1860
The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.8. This is due to the `get_items_permissions_check()` permission callback on the `/kaliforms/v1/forms/{id}` RES…
Vulnerability class: Broken Access Control
EPSS: 0.000 (1.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/a1529c89-5c5e-4a2d-be31-b55d2…
- plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.8/Inc/Backend/Rest/class…
- plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.8/Inc/Backend/Rest/class…
- plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.8/Inc/Backend/Rest/class…
- plugins.trac.wordpress.org/changeset/3460047/kali-forms/trunk
Frequently asked questions
- What is CVE-2026-1860?
- CVE-2026-1860 is a medium-severity vulnerability in Wpchill Kali Forms — Contact Form & Drag-and-drop Builder, classified under Missing Authorization. CVSS score: 4.3/10. Published 2026-02-18.
- How severe is CVE-2026-1860?
- Medium severity. CVSS v3 base score is 4.3 out of 10.