Kali Forms Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Kali Forms plugin for WordPress, affecting all versions through 2.4.9. The issue arises in the 'form_process' function, where user-supplied keys are directly mapped into internal placeholder storage. This, combined with the use of 'call_user_func' on these placeholder values, allows unauthenticated attackers to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution on the server where the affected WordPress site is hosted.

Reproduction

To reproduce this vulnerability, send a request to the WordPress site with the 'form_process' action. Include crafted submission data that exploits the 'prepare_post_data' function by overwriting internal placeholders with keys that match real form fields. This will trigger the execution of arbitrary code via the manipulated placeholders.

Remediation

Users are advised to update the Kali Forms plugin to version 2.4.10 or later.