CVE-2026-1860: 
WordPress vulnerability analysis and mitigation

CVE-2026-1860 is an Insecure Direct Object Reference (IDOR) vulnerability in the Kali Forms plugin for WordPress, affecting all versions up to and including 2.4.8. The flaw allows authenticated attackers with Contributor-level access or above to read form configuration data belonging to other users, including administrators, by enumerating form IDs via the /kaliforms/v1/forms/{id} REST API endpoint. It was published on February 18, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, CIRCL).

The root cause is a Missing Authorization flaw (CWE-862) in the get_items_permissions_check() permission callback on the /kaliforms/v1/forms/{id} REST API endpoint. The callback only verifies that the requesting user has the generic edit_posts capability, without confirming ownership or authorization over the specific form resource being requested. This allows any authenticated user with at least Contributor-level access to enumerate form IDs and retrieve configuration data for forms they do not own, including those created by administrators (Red Hat CVE, CIRCL).

Successful exploitation exposes sensitive form configuration data, including form field structures, Google reCAPTCHA secret keys (if configured), email notification templates, and server file paths. Exposure of reCAPTCHA secret keys could allow attackers to bypass CAPTCHA protections on affected sites, while server path disclosure may facilitate further attacks. The vulnerability is limited to confidentiality impact with no direct integrity or availability consequences (Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The EPSS score is very low at approximately 0.007%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level authenticated account on the target WordPress site (CIRCL).

1. Reconnaissance: Identify WordPress sites running the Kali Forms plugin (version ≤ 2.4.8) by inspecting page source, plugin directories, or using tools like WPScan.
2. Obtain Contributor Access: Register or compromise a Contributor-level (or higher) WordPress account on the target site.
3. Enumerate Form IDs: Send authenticated GET requests to the REST API endpoint /wp-json/kaliforms/v1/forms/{id}, incrementing the {id} parameter to enumerate existing form IDs.
4. Extract Sensitive Data: For each valid form ID, parse the API response to collect form field structures, Google reCAPTCHA secret keys, email notification templates, and server path information.
5. Leverage Exposed Data: Use harvested reCAPTCHA secret keys to bypass CAPTCHA protections, or use server path information to inform further attack attempts against the target environment (Red Hat CVE, CIRCL).

• Network: Repeated authenticated GET requests to /wp-json/kaliforms/v1/forms/{id} with sequentially or randomly incrementing integer IDs from a single source IP.
• Logs: WordPress access logs showing a high volume of REST API requests to the Kali Forms endpoint (/wp-json/kaliforms/v1/forms/) from a Contributor-level user account in a short time window.
• Logs: HTTP 200 responses to form ID enumeration requests from accounts that do not own the corresponding forms.

Users should update the Kali Forms plugin to a version beyond 2.4.8 that includes a fix for this authorization check. The remediation requires the plugin's get_items_permissions_check() function to verify that the requesting user is the owner of or is otherwise authorized to access the specific form resource, not merely that they hold the edit_posts capability. Until a patched version is available, site administrators should consider restricting Contributor-level registrations or disabling the Kali Forms REST API endpoint via firewall rules if feasible (Red Hat CVE).