Kali Forms WordPress Plugin Unauthenticated File Upload Vulnerability

A vulnerability exists in the Kali Forms WordPress plugin, specifically in versions prior to 2.4.17. The issue arises because the plugin does not properly verify file uploads against existing forms with file-upload fields. This oversight allows unauthenticated users to upload files to the WordPress Media Library. While the uploads are restricted to WordPress's default-allowed MIME types, preventing code execution, the lack of validation poses a significant risk by enabling unauthorized file uploads.

Impact

Exploitation of this vulnerability allows for unauthenticated arbitrary file uploads to the WordPress Media Library. The uploaded files are publicly accessible and can be retrieved from the Media Library. Although the vulnerability does not lead to code execution due to WordPress's MIME type restrictions, the uploaded files are scheduled for automatic deletion approximately 15 minutes after upload.

Reproduction

The vulnerability can be reproduced in two steps. First, leak a valid nonce by sending a POST request to 'wp-admin/admin-ajax.php' with the action 'kaliforms_get_js_var', specifying a form ID. The response will include the nonce. Next, upload a file using the leaked nonce by sending a POST request to 'wp-admin/admin-ajax.php' with the action 'kaliforms_form_upload_file', the nonce, and the file to be uploaded. If the upload is successful, the response will include a unique ID string. The uploaded file can then be accessed from the WordPress uploads directory.

Remediation

Users are advised to update the Kali Forms WordPress plugin to version 2.4.17 or later.