Kali Forms RCE: WordPress Sites Under Attack

A critical Remote Code Execution (RCE) vulnerability in the Kali Forms WordPress plugin has escalated into an active threat, allowing unauthenticated attackers to compromise sites. According to The Cyber Express, this flaw, impacting a drag-and-drop form builder with over 10,000 active installations, was exploited in the wild almost immediately after its public disclosure.

The vulnerability, initially reported on March 2, 2026, through a bug bounty program, saw a patched version (2.4.10) released on March 20, 2026. However, the same day saw attackers initiating widespread exploitation campaigns. The Cyber Express detailed a rapid disclosure-to-exploitation cycle, with peak activity observed between April 4–10, 2026, targeting all versions up to and including 2.4.9.

The technical root cause lies within the form_process flow and the prepare_post_data() function. This function improperly maps attacker-controlled input into internal placeholder storage without adequate validation, allowing arbitrary PHP function names to be injected and subsequently executed via call_user_func() in the _save_data() method. This lack of input restriction makes exploitation relatively trivial, enabling full Remote Code Execution for unauthenticated users.