{"cvss":0.0,"datePublished":"2026-03-20T00:00:00Z","dateUpdated":"2026-03-20T00:00:00Z","description":"The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.","dueDate":"","id":"CVE-2026-3584","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"Kali Forms","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"kaliforms contact_form_builder Improper Control of Generation of Code","vendor":"WP Chill"}