{"id":"CVE-2026-39782","kind":"vulnerability","aliases":["CVE-2026-39782"],"related":[],"title":"Kali Forms WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.","summary":"Kali Forms, a WordPress form plugin, has a missing authorization check that lets a request bypass its access control settings. The sources do not say what data or actions an attacker can reach through it.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kali-forms","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Kali Forms plugin version in the WordPress admin plugins list or the plugin header of `kali-forms`\n- Confirm whether the installed version is `2.4.27` or earlier","fix":"- Move Kali Forms to a version later than `2.4.27` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-10-29T14:17:54+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:05+00:00","updated_at":"2026-10-29T14:26:05+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T14:26:05Z","model":"claude-haiku-5-5","output":{"fix":"- Move Kali Forms to a version later than `2.4.27` (the sources do not name the exact fixed release)","reach":"internet","title":"Kali Forms WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"Kali Forms, a WordPress form plugin, has a missing authorization check that lets a request bypass its access control settings. The sources do not say what data or actions an attacker can reach through it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","kali-forms"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access control bypass exposes form data or settings","analyst_note":"Check the NVD entry and the Wordfence or plugin changelog for the fixed version and what the bypass exposes.","how_to_check":"- Check the installed Kali Forms plugin version in the WordPress admin plugins list or the plugin header of `kali-forms`\n- Confirm whether the installed version is `2.4.27` or earlier\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Kali Forms WordPress plugin at version 2.4.27 or earlier are affected. Sites that do not use this plugin can skip it. The sources do not say which access control settings are bypassed or what an unauthenticated visitor can reach.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000682,"input_tokens":4115,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-39782':13A,16A '2.4.27':80C 'access':9A,39B,69C 'action':50B 'affect':74C 'allow':65C 'attack':52B 'author':6A,31B,56C 'bypass':37B 'check':7A,32B 'configur':68C 'control':10A,40B,70C 'cve':11A,14A 'data':48B 'exploit':66C 'expos':8A 'form':2A,19B,23B,26B,61C,64C,76C 'incorrect':67C 'issu':73C 'kali':1A,18B,22B,60C,63C,75C 'kali-form':17B,62C 'kaliform':59C 'let':34B 'levels.this':72C 'miss':5A,30B,55C 'n/a':78C 'packag':20B 'plugin':4A,27B 'reach':54B 'request':36B 'say':46B 'secur':71C 'set':41B 'sourc':43B 'vulner':57C 'wordpress':3A,21B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Kali Forms WordPress plugin at version 2.4.27 or earlier are affected. Sites that do not use this plugin can skip it. The sources do not say which access control settings are bypassed or what an unauthenticated visitor can reach.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-39782","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39782","severity":null,"published_at":"2026-10-29T14:17:54+00:00","modified_at":"2026-10-29T14:17:54+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}